@claus, see attachment.

URL leads to a login page with avatar of the admin of the instance at the top of the page.

The text makes it obvious that it's automated.

So, for now just a regular dumb phishing.