After the inspection, Unfortunately, I am likely to take back what I said. Since the last update (perhaps when they are rage banned our account), they seem to have fully implemented a check in game client. If you don’t know what I am talking about, the check requires the game client to respond to specific messages. Request will be rejected with 403 HTTP code when downloading Avatar if you don't answer. If I remember correctly, there was a news from other avatar ripping server earlier, but VRChat had not fully implemented this method at that time. [Note: above said may contains incorrect information, please don't take seriously]
The measure is quite targeted to prevent anyone from downloading Avatar without opening the game client. We are sure that VRChat has noticed us. Some of our trap accounts (the accounts that have never been used and used to determine their ban actions) and are even banned twice. Calm, tupper.
But we are prepared in advance. I have proposed a plan called 'Dead Hand' (Name is a meme from Russia) a few months ago. The plan will disclose all ID-Downloader code and data after this situation, so any of everyone can continue our research and continue to download VRChat Avatar/World.
I think it's time to start this plan. We are ABLE to continue playing this cat & mouse game, but we have no money to play it lol. This measure does increase our cost of continuing to run ID-downloader, and I don't want to throw off too much money on a free project.
Remember, VRChat don't care you.

In short, the following content will be open source/reveal:

VRChat Mass Register Bot
VRCPirate ID-Downloader PHP Source
VRCPirate ID-Downloader Data (Exclude privacy data)

ID-Downloader will be continue for world download.

Later, I will consider publishing these code/data from multiple places to avoid DMCA.
And, I need some time to document the code.

Still a good news? or not? Your idea.
I believe anyone can be the next VRCPirate!

Thanks