[lmf22]

I received an email that looks very much like it was from Audiogon.  It says:
 
New Message from AudiogoN Customer
From: joeabrams    11/17/2013
joeabrams started a conversation with you.
To see the message click here.
 
(See screenshot of the email below). 
 
When I clicked on the link it goes to a page that looks like Audiogon's page, but web address is "http://app-audiogon.co.uk/signin" and it asked me to log in.  I did not type in my user and password of course.  
 
 

 

[jpa57]

I just got the same thing at 9:59 PST.   It seems to be grabbing your credentials and then directing you to the real web site, where you will not find a message from joeabrams.   You can type anything into the login page and it will take you to the real site without complaint.   Pretty good fake I have to say.  Not really sure why they would want to target audiogon.

 

[Hi-Finthen]

 

[billybob_jcv]

Probably a compromised server, but here's the whois on app-audiogon.co.uk:

Domain name:
app-audiogon.co.uk

Registrant:
Susan Du Pre

Registrant type:
UK Individual

Registrant's address:
15 Mitchell Walk
Bristol
BDF
BS30 5XY
United Kingdom

Registrar:
1 & 1 Internet AG [Tag = SCHLUND]
URL: http://www.1and1.co.uk or http://registrar.1und1.info

Relevant dates:
Registered on: 15-Nov-2013
Expiry date: 15-Nov-2015
Last updated: 15-Nov-2013

Registration status:
Registered until expiry date.

Name servers:
ns-uk.1and1-dns.biz
ns-uk.1and1-dns.co.uk
ns-uk.1and1-dns.com
ns-uk.1and1-dns.org

 

[djdonis]

I got the same message. The interesting thing is that it was sent to my email address used only for Audiogon that I set up quite recently (within a month or so). I suspect that Audiogon customer database has been hacked.
 
The server address is somewhat different: http://audiogon-a.co.uk/signin