If you google the domain it looks like it was compromised by some guy who owns the instagram account mwr and goes by 'SLNTAR' as seen in a mirror of the website from May 18 2018. It looks like the owner of the website has regained control but it's possible the website is still under the attackers control.
Considering that the domain is
still being used as a phishing site to steal login credentials, I would say whoever currently is in control of the domain is the culprit.