{ "compartment_id": "section-12", "number": "Section 12", "title_local": "Enforcement feasibility: domain-level blocking", "title_english": "Enforcement feasibility: domain-level blocking", "source_url": "https://phishdestroy.io/steam_dossier/#autoban-feasibility-section", "source_document": "index.html", "content": { "html": "
\n
\n
\nPart B — Rules and enforcement record · Section 12\n

The hostname is already in the request.

\n\n
Context & source limits

Valve already maintains a domain list (the Link Filter) and already receives the auth hostname in every OpenID request. The pseudocode below shows the logical shape of connecting the two. No public evidence shows that Valve does so.

\n

Valve already runs a domain blocklist. Valve already receives the login host in every OpenID request. Nothing needs building — the two have to be joined. That is a hostname lookup against a list Valve maintains itself. The pseudocode below is an illustration, not Valve's implementation.

\n
\n
\n
\nforensic_autoban.py\n
\n\n\n\n
\n
\n
\n
# ILLUSTRATIVE PSEUDOCODE — Valve.block_domain() and flag_session_as_mitm() are not real API calls. This demonstrates the logical structure of a mitigation Valve could implement against proxy auth domains, not actual Valve internals.
\n
# Illustration: the logical shape of a check on the incoming OpenID request
\n
def audit_openid_request(request):
\n
blocked_origins = database.get_blacklisted_platforms()
\n
proxy_domain = request.params.get('openid.realm')
\n
target_redirect = request.params.get('openid.return_to')
\n
\n
# Logic: If the proxy routes back to a blocked site, ban the proxy.
\n
for site in blocked_origins:
\n
if site in target_redirect:
\n
Valve.block_domain(proxy_domain)
\n
Valve.flag_session_as_mitm(request.session)
\n
# Result: the login request for that host is refused
\n
\n
\nObservation:
\nWhere a main domain is already on the Link Filter (e.g. howl.gg, blocked 2026-09-18/19/21) and its auth host (howl.uno) appears in the OpenID request from that site's login button, the association is observable to Valve from its own request data. The check is automatable; whether it is run is not.\n
\n
\n
\n
\n
\n

Documented and reported precedents

\n

\n Valve has intervened against a third-party operator at least once on the record: in 2018 it revoked OPSkins' access over the ExpressTrade system (Valve's announcement ↗ archived 2026-03-07 ↗). Community reports from 2018 also describe a marketplace (SkinJar) losing access; those reports are unverified and the mechanism is inferred from the outcome, not from a disclosed process.\n

\n
\nWhat the precedent establishes:\n

\n Valve can cut off a third-party operator's access when it decides to. CSGOFast, named in press reports of the July 2016 notices, was operating on 2026-09-21 with an auth host registered 2026-06-30 that returned no Link Filter block. Why one operator was cut off and others were not is not explained by any published criteria.\n

\n
\n
\n
\n

What a registration date does and does not show

\n

\n The registration date of an auth host is a lower bound on when the host could first have appeared in an OpenID request; it does not establish continuous use. sc-auth.net, for example, was registered 2019-04-02 (RDAP) and was observed in Skin.Club's Steam login flow in September 2026; what happened between those two dates is not in the public record.\n

\n
\n
\n
\n\n
\n
\n

Comparative Audit: API Compliance Standards

\n
\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Enforcement DimensionGitHub API RulesSteam Web API (Valve)
1. Compliance NeutralityPublished, uniform rules. Documented rate limits (e.g. 5,000 calls/hr for authenticated users, 15,000/hr for GitHub Enterprise Cloud organisations) and published acceptable-use policies apply to every account.No published criteria. Individual accounts are terminated under the automation and commercial-use clauses (archived complaints), while no per-operator enforcement record for commercial platforms has been published.
2. OpenID / Auth Proxy AbuseGitHub's published policies allow OAuth apps and tokens to be suspended or revoked for abuse, and its documentation describes automatic revocation of exposed tokens (authors' summary of GitHub documentation).Separate-domain auth hosts observed in Steam OpenID flows (e.g. rbsnin.com, howl.uno, sc-auth.net) returned no Link Filter block on 2026-09-21 while their main domains did.
3. Monetization of AbuseGitHub takes no transaction fee on items moved by third-party automation; its revenue model is subscriptions and marketplace listings.Valve sells the case keys that produce the items, and the Community Market charges a combined fee of about 15% on sales completed inside the Market. No figure for revenue attributable to third-party platforms is estimated here.
4. Evasion Loop LifespansSuspended OAuth client IDs stop working platform-wide at suspension; the documentation does not publish a time-to-action figure and none is assumed here.Separate-domain auth hosts with registration dates from 2011 to September 2026 returned no Link Filter block in the checks of 2026-09-19 and 2026-09-21. Registration date is a lower bound on possible use, not proof of continuous use.
\n
\n
Sources: GitHub column — GitHub's published API rate-limit and platform-policy documentation (authors' summary, not quoted) · Steam column — Link Filter checks of 2026-09-19 and 2026-09-21 (linkfilter-recheck-2026-09-21.json), RDAP registry (domain-registration.json) and the archived support complaints (evidence archive).
\n
\n
\n
" }, "original_content_sha256": "36da3f19cd58cb00bce5ee5150cebb1605dfdf65161dffff2d508c82ec8dadfd", "author_pseudonym": "Agent Randall", "schema": "phishdestroy.macro-fact.v1", "language": "en", "aggregator": "PhishDestroy", "exports": { "pdf": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_12_agent_randall.pdf", "json": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_12_agent_randall.json", "signature": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_12_agent_randall.json.asc" }, "integrity": { "signed_object": "steam_dossier_section_12_agent_randall.json", "signature_file": "steam_dossier_section_12_agent_randall.json.asc", "signing_key_fingerprint": "129FC7F39C40C69D2EF3C329BFCF9E8DD295EE01", "scope": "Exact JSON bytes, including macro-fact author and corresponding PDF SHA-256. PhishDestroy is the integrity signer; original evidence attribution is unchanged." }, "pdf": { "filename": "steam_dossier_section_12_agent_randall.pdf", "sha256": "3f052aed524af33e00c041d157f8b3d96557089c9878429b4834a4927a7df6aa", "pages": 4 } }