How many users do not have this blocked - static dot addtoany dot com?

[polonus]

A great many websites have this running:
https://publicwww.com/websites/%22static.addtoany.com%22/3
being worked through Cloudflare cloud-service: https://www.shodan.io/host/104.22.71.197
B-grade scan: https://www.ssllabs.com/ssltest/analyze.html?&hideResults=on&d=static.addtoany.com

Why it'd better be blocked: https://www.virustotal.com/gui/ip-address/104.22.70.197/relations

polonus (volunteer 3rd party cold recon website security analyst and website error-hunter)

[polonus]

A random example of such a website ith static.addtoany.com script follows here, e.g.:
wXw.mycoronadiet.com

Also one engine to alert this a a PHISHing site: https://www.virustotal.com/gui/url/0cdde3aa391f831d294c28e62fe23d2ce0cffc54302d5fefa5076531f873f44c/detection

When we scan the http:// version of that site against DOm-XSS sinks and sources,
we get for the main site: Number of sources found: 14
Number of sinks found: 122

But we also stumble upon -https://www.kurapica.net/  &  -https://yourcreditjeweler.net/ & -https://interine.net
last two cannot be reached! (What is going on there at ASTRALUS in the Netherlands/Leaseweb related?).

Furthermore we get: Results from scanning URL: -https://www.mycoronadiet.com/wp-includes/js/imagesloaded.min.js?ver=3.2.0
Number of sources found: 0
Number of sinks found: 3

Results from scanning URL: -https://www.mycoronadiet.com/wp-includes/js/masonry.min.js?ver=3.3.2
Number of sources found: 0
Number of sinks found: 2

Results from scanning URL: -https://www.mycoronadiet.com/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.1.7
Number of sources found: 4
Number of sinks found: 8

Results from scanning URL: -https://www.mycoronadiet.com/wp-content/themes/twentyseventeen/assets/js/navigation.js?ver=20161203
Number of sources found: 17
Number of sinks found: 2 

etc. etc.

Linked sites: Linked Sites
Google Safe Browse checks have been performed on each of the linked sites. Links with poor reputation could be a threat to users of the site. Hosting and location are also included in the results.

Externally Linked Host   Hosting Provider   Country   
    -www.facebook.com   Facebook.   Ireland    
    -www.instagram.com   Facebook.   Ireland    
    -www.youtube.com   Google LLC   United-States    
    -www.pinterest.com   Akamai Technologies.   United-States   

Privacy impact score: B - https://webcookies.org/cookies/mycoronadiet.com/30471321?905386

Third party persistent httpOnly cookie:
uvc
Generic AddThis tracking cookie

» More...
Type: HTTP Cookie
Domain: -addtoany.com
This cookie expires in 1 days
Secure The cookie sets the Secure flag but is itself set on a non-TLS (plaintext HTTP) website. New browsers will ignore such cookies under the Strict Secure cookie policy
httpOnly This cookie can be read by client-side JavaScript which might increase chances of stealing it in case of a successful Cross-Side Scripting attack. It's recommended that cookies storing authentication-related session token are protected by the flag

As we stated above this a link to -https://webcookies.org/cookies/static.addtoany.com/2353367
which is blacklisted and with Type: Suspicious Pattern: generic_javascript_obfuscation4
JavaScript obfuscation is frequently used to hide malicious code (or with hope to protect intellectual property)

 Type: Suspicious Pattern: generic_javascript_obfuscation5
JavaScript obfuscation is frequently used to hide malicious code (or with hope to protect intellectual property)
static.addtoany dot com/2353367 comes listed at Ultimate.Hosts.Blacklist  (Q.E.D.)

Q.E.D., in this case we arrived back at the starting point of the discussion in this topic on -addtoany tracking.

polonus (volunteer 3rd party cold recon website security-analyst and website error-hunter)