[Invertigrate]

Just looked this up for myself and it's indeed partially correct (mostly webp, jpg, png, etc though).

You left out an important part which is that they're proxying these requests through their own servers to avoid the source being found.

This way they could be placing the files on servers that actually require some sort of authentication such as a login page and once that's done the sky is their limit as you could even be hosting files on Discord and it would be very difficult to find the source.

User -> Pirate proxy server -> Github (or some other site)