If you are downloading Firefox by going to www.mozilla.com then they are most certainly not linking to malware sites. http://mirror.csclub.uwaterloo.ca/pub/mozilla.org/ (The Univeristy of Waterloo) for example is actually one of the official secondary mirrors used to help balance the load on releases.mozilla.org Mozilla does not have just one or two servers for Firefox downloads as that would not be able to handle the load, especially during new releases of Firefox, more so if release in coincides with Thunderbird and SeaMonkey releases in same period. The list of primary and secondary mirrors servers for releases.mozilla.org is at http://www.mozilla.org/community/mirrors.html