the issue with that would be that it's not an exhaustive list. people would feel wrongly safe because they don't visit those websites while in theory a lot more websites could be infected.

Any site hosting any sort of popular blogging or forum software would've been a potential vector.

I’m guessing it was pushed through ad-networks, as usual.