Newest Threads

**JonW** · 08-07-2010, 07:35 PM

I was doing some research on yeasts this morning and kept getting some warnings about the fermentis.com (Safale) website. Google is showing that some of their pages are loading malware from Russian websites.

http://www.google.com/safebrowsing/diagnostic?site=http://www.fermentis.com/fo/60-Beer/60-11_product_rangeHB.asp&hl=en

drummerguysteve · 08-09-2010, 01:44 AM

I just ran across that as well. I was hoping to find some flavor profiles of their yeasts. Anyhow, thanks for the warning! Hopefully they're up and running soon.

GuldTuborg · 08-09-2010, 02:53 AM

It's been like that for a while. I wonder what the deal is? Does anyone know what's going on, exactly? I'd like to check their info sheets periodically, but I hesitate due to this warning.

sigurdur · 08-09-2010, 08:30 AM

You can go to their french website, that one does not have a warning attached to it.
http://www.fermentis.fr/FO/60-Beer/60-11_product_rangeHB.asp

It's in English and allows you to view all the info sheets.

stubbornman · 08-09-2010, 02:36 PM

They have an infection!!

hal2814 · 08-09-2010, 02:59 PM

Some of the javascript code they use is stored on a Russian server that was also hosting malware. There's nothing wrong with Fermentis' site. They just chose a poor place to either host or reference some code.

samc · 08-09-2010, 03:16 PM

You can also find some of them here http://www.williamsbrewing.com/SAFALE_S04_DRY_ALE_YEAST_P720C64.cfm

**JonW** · 08-09-2010, 04:42 PM

Quote:

Originally Posted by hal2814

Some of the javascript code they use is stored on a Russian server that was also hosting malware. There's nothing wrong with Fermentis' site. They just chose a poor place to either host or reference some code.

According to the Google crawler, they were serving up malware.

From the Google diagnostic page:
What happened when Google visited this site?
Of the 3 pages we tested on the site over the past 90 days, 3 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2010-07-25, and the last time suspicious content was found on this site was on 2010-07-25.
Malicious software is hosted on 5 domain(s), including postfolkovs.ru/, webservicebal.ru/, webserivcezub.ru/.
This site was hosted on 1 network(s) including AS35012 (PICTIME).

hal2814 · 08-09-2010, 05:16 PM

Quote:

Originally Posted by JonW

According to the Google crawler, they were serving up malware.

From the Google diagnostic page:
What happened when Google visited this site?
Of the 3 pages we tested on the site over the past 90 days, 3 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2010-07-25, and the last time suspicious content was found on this site was on 2010-07-25.
Malicious software is hosted on 5 domain(s), including postfolkovs.ru/, webservicebal.ru/, webserivcezub.ru/.
This site was hosted on 1 network(s) including AS35012 (PICTIME).

No, according to Google's site, those .ru servers were serving up malware. fermentis.com was not. Read the rest of the diagnostic page:

Quote:

Has this site acted as an intermediary resulting in further distribution of malware?
Over the past 90 days, www.fermentis.com did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?
No, this site has not hosted malicious software over the past 90 days.

How did this happen?
In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

(emphasis mine)

**JonW** · 08-09-2010, 05:23 PM

I read it all. I think you are misinterpreting what they are saying.

Just as you said in your first post on the subject, Fermentis is linking to external javascript - and that is where the linking to the malware is taking place. The malware is not ON their site, but because they are using external code (that was likely compromised), their web pages (not site) ends up serving up the malware. Just because the malware is not sitting on their server doesn't mean they're not serving it up. They were not simply implicated because some other site had malware on the same server - they were actively serving it up.

Here's the key point from the Google report:
resulted in malicious software being downloaded and installed without user consent