Fake Audiveris Website Scam

[bluechetti]

I almost got tricked by a fake version of Audiveris, the open-source sheet-music scanner. I thought I was downloading it from a legit site called “audiveris.com,” but it turns out the real project only exists on GitHub. The fake site copied the real GitHub page, used made-up contributor names, and had a clean “Download for Mac” button that actually linked to malware. The real Audiveris doesn’t have an installer—it’s a Java .jar file you get from the GitHub “Releases” section. If it’s not from github.com/Audiveris/audiveris, it’s fake.

This almost happened to me a second ago too with another software called finale.

[hbitteur]

@bluechetti
Thanks a lot for pointing to this fake site I never heard about.
It looks so real! Except the "Hepls" (sic) center.

FYI, the real Audiveris site on GitHub does have installers since release 5.5.3

But what can we do? I used to own the audiveris.com and audiveris.fr domains, I just kept the audiveris.org domain.
So anybody on earth can use audiveris.com for whatever purpose, that's the problem.

Do you have an idea on how we can fight this?

[jlpoolen]

Hervé, Alas, you are going to need legal counsel. I was an attorney for 40 years and resigned from all bars as I no longer have confidence in the judicial system of the United States. Therefore, I can no longer practice law. Were that I could help you, you have done so much good.

[hbitteur]

@bluechetti

I have reviewed again this audiveris.com site.
I can't tell for the macOS and the Linux downloads.

For Windows, the downloaded file is a Audiveris-5.7.1-windows-x86_64.zip file, which contains a Audiveris-5.7.1-windows-x86_64.rar file, which contains a Audiveris-5.7.1-windows-x86_64.msi file.
What is the purpose of wrapping a file into a .rar and a .zip???
Perhaps I'm naive.

I computed the SHA256 signature of the .msi file:
sha256:524e5701a3bd0a07d33df84adc5a53062949ca41ef833623c2adde39f7f7cb14

It's the same signature as the original Audiveris-5.7.1-windows-x86_64.msi asset of the 5.7.1 release on the github site.
So, is it really a malware?
I also checked the downloaded .zip file with my Avast antivirus, nothing detected.

Again, my remark applies only to the Windows download.

[olizam]

At the bottom of the page there is a clear disclaimer that says Not affiliated with Audiveris. This is an independent site providing documentation, guides and links to the official project repositories. For official releases visit GitHub. Does this mean we can't do anything about it?

[hbitteur]

@olizam
Yes, I already noticed this paragraph.

What I find puzzling is the purpose of this site, so beautiful, so impressive, so dithyrambic, yet misguiding.

At the top of the page, there are two buttons:

• a "Download Now" button which points to the GitHub Audiveris project. Fine.
• a "Learn More" button which points to a guide.
  This guide is composed of 8 small articles, all provided by "Michal" and all dated September 23, 2025.
  Perhaps they were AI-generated. Audiveris there is said to export MIDI files, which is wrong.

Around the middle of the page, the section "Download Audiveris" presents 3 buttons:

• Download for Windows: we get a .zip of a .rar of an old (yet correct) .msi file
• Download for macOS: we get back to the top of the page with its "Download Now" button
• Download for Linux: we get a small .zip file, which seems too small to be an installer

Then there is a "Join Our Community" section, which gives:

Item	Value	My comment
Active users	50k+	From GitHub: about 5000 downloads per month
Score Processed	2M+	How could we know this number?
Contributors	150+	From GitHub: 28
Accuracy Rate	98%	I would adore such number!

There is also a "Contact us" page, but I got no answer for the message I sent them.

[hbitteur]

FYI, here is the mail I sent to abuse@spaceship.com:

Hello,

My name is Hervé Bitteur, owner of the Audiveris open-source project, hosted on GitHub.

I own the "audiveris.org" domain since more than 10 years now.

Recently, some one brought my attention to a site named "audiveris.com" (yes, .com instead of .org).
This site looks nice and professional, is dithyrambic about the Audiveris software, with buttons said to "download" it.

Except that all this seems unreal and the downloading is very suspicious.
Please have a look at the couple of messages exchanged about this site on the Audiveris discussions forum.

At the very end of this site, there is a bottom line saying "Not affiliated with Audiveris. This is an independent site providing documentation, guides and links to the official project repositories. For official releases visit GitHub"

So, they claim they have no connection with Audiveris, but they are in fact misrepresenting my activity.

What is the purpose of this "fake" site?

And what can you do to help me?

Thanks in advance,

--
Hervé Bitteur

And here is their answer:

Hello,

This is to confirm that your complaint has been received and reviewed.

In order to avoid any misunderstanding, we would like to inform you that Spaceship is currently providing only registration services for the domain name in question, therefore, we are not aware of the exact purpose of the service.

To have the content disabled, it is advised to contact either a website administrator or the hosting provider company. The hosting provider's contact details can be found at https://whois.domaintools.com/108.181.242.156

If the contact details are protected by the WHOIS protection service, it is possible to reach the owner by using the dedicated contact form. For this, please follow https://www.spaceship.com/domains/whois/ , fill in the domain name and hit enter, scroll down to the “Contact domain registrant” hyperlink, and hit it. In the pop-up windows that appear, fill in the details such as your email address and the desired message, and click the “Submit” button. Your message will be forwarded to the real email address of the corresponding domain holder.

Should you have further questions, please let us know.

Best regards,
Spaceship Team

[hbitteur]

https://whois.domaintools.com/108.181.242.156 seems to refer to the hosting provider.
Here is the beginning of this site image:

[hbitteur]

While https://whois.domaintools.com/audiveris.com seems to refer to audiveris.com:

[hbitteur]

Could someone help us decipher all this?

[hbitteur]

Following the spaceship advice:

If the contact details are protected by the WHOIS protection service, it is possible to reach the owner by using the dedicated contact form. For this, please follow https://www.spaceship.com/domains/whois/ , fill in the domain name and hit enter, scroll down to the “Contact domain registrant” hyperlink, and hit it. In the pop-up windows that appear, fill in the details such as your email address and the desired message, and click the “Submit” button. Your message will be forwarded to the real email address of the corresponding domain holder.

I just submitted my request to the domain registrant:

[hbitteur]

FYI, I just added a WARNING on the audiveris.github.io page.

Perhaps I should put a similar warning on the https://github.com/Audiveris/audiveris page as well.

[bluechetti]

I apologize I may have mistook that it as malware tbh, I just realized it was fake and got the fear of god spooked into me. I hope you understand. I appreciate you doing something about this. This software is awesome and I wouldn't want someone to fall for something bad.