Beat my head against the wall when actually the instance was just down and s****p didn’t indicate that very well 
Got the flag now; overall pretty tricky I’d say. I for sure thought it’d be an XSS one based on the contact form until I followed the other leads.
Feel free to ping me for hints.