What's inside the login portal? I honestly don't know and am genuinely asking but the article didn't seem to go into it, but if the login portal leads to a page

What's inside the login portal? I honestly don't know and am genuinely asking but the article didn't seem to go into it, but if the login portal leads to a page with a btc/other crypto address and a text box where the attacker enters ubuntu.com and a submit button labeled DDoS, should that bit be legal?