Code in URLs despite clean URLs turned on
According to this posting on StackOwerflow and this one on Drupal Answers, these appear if there is Javascript in place to add "AddThis" tracking to the website.  They do no harm, and if it's not your site, you should leave them alone.

(Note that this has nothing to do with clean URLs in Drupal.  Drupal's clean URLs changes things like example.com/?q=node/123 into  example.com/node/123.  It does nothing with hashmarks added to URLs.)