Just looking at those domains/paths, these are all probably parts of sites that allow user uploads for various legitimate purposes . Presumably, AI scammers have realized that they can upload shit there and use them for free hosting with a legit-seeming domain that will pass through web filters that aren’t scanning the content of pages. When I used sketchy debrid services ages ago, they were often hosted on student hosting for universities or hospital websites in various SEA countries.