{ "compartment_id": "section-3-2", "number": "Section 3.2", "title_local": "The Big Picture Trap: Multi-Year Longitudinal Phishing Audit (120 Domains)", "title_english": "The Big Picture Trap: Multi-Year Longitudinal Phishing Audit (120 Domains)", "source_url": "https://phishdestroy.io/steam_dossier/#linkfilter-coverage", "source_document": "index.html", "content": { "html": "
\nPrimary Empirical Audit · Multi-Year Date Range\n

The Big Picture Trap: Link Filter is Compliance Theater, Not a Shield

\n

On desktop browsers, users are shielded by external defenses: Google Safe Browsing and Microsoft SmartScreen intercept known phishing with full-screen red warnings. Inside Steam's Big Picture mode, the in-game overlay (Shift+Tab), and the Steam Deck (SteamOS), those defenses do not exist. The embedded browser supports zero extensions, disables external Safe Browsing engines, and leaves the user with exactly one defensive barrier: Valve's linkfilter interstitial.

\n

Swipe to compare all four results →

\n
\n
92.5%
2025–2026 modern edge phishing passed clean (37/40)
\n
77.5%
2023–2024 CS2 era phishing passed clean (31/40)
\n
70.0%
2021–2022 legacy phishing passed clean (28/40)
\n
7 / 7
gambling mains blocked (positive control)
\n
\n
\n
Multi-Year Longitudinal Audit: 120 Pure Steam Phishing Domains Tested Live (24 Sep 2026)
\n

To test whether Valve's filter is simply slow to ingest new threats or fundamentally blind to them, we audited 120 confirmed Steam-specific phishing domains across three historical cohorts against steamcommunity.com/linkfilter:

\n\n
\n
\n

Telemetry & Liability Shield, Not Protection. Why does the Link Filter exist if it passes 70% to 92.5% of pure Steam phishing? It functions as a corporate liability disclaimer and an outbound click telemetry sensor. By presenting a polite \"You are leaving Steam\" notice with a clickable green proceed button, Valve shifts legal blame onto the victim under the Steam Subscriber Agreement (*\"the user voluntarily navigated outside Steam\"*). Valve collects the telemetry of the click, but does not block the theft.

\n

The Favicon Hash Proof: Zero Ingestion of Threat Feeds. Independent threat intelligence platforms (urlscan.io, Shodan, Censys) identify live Steam phishing kits using a simple search for Steam's official favicon hash (page.favicon.hash:9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad NOT domain:*.steampowered.com). This basic automated check surfaces active phishing clusters in seconds. Valve does not sync with external feeds, does not run hash-based threat hunting, and only manually intervenes when compelled by regulators (the 2016 WSGC gambling order) or to protect its trademarked domain strings.

\n
\n

Primary audit evidence artifacts: Longitudinal 120-domain multi-year audit: longitudinal-steam-phishing-audit.json · 100 dedicated Steam phishing sample: linkfilter-steam-phishing-100.json · Broad feed audit (n=250): linkfilter-coverage-2026-09-22.json.

\n
" }, "original_content_sha256": "4def8361e1d01086a3f490b21c2cbd72e77df63fc2287a039cca1ca2bbe5f55f", "author_pseudonym": "Agent Ignatus", "schema": "phishdestroy.macro-fact.v1", "language": "en", "aggregator": "PhishDestroy", "exports": { "pdf": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_3_2_agent_ignatus.pdf", "json": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_3_2_agent_ignatus.json", "signature": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_3_2_agent_ignatus.json.asc" }, "integrity": { "signed_object": "steam_dossier_section_3_2_agent_ignatus.json", "signature_file": "steam_dossier_section_3_2_agent_ignatus.json.asc", "signing_key_fingerprint": "129FC7F39C40C69D2EF3C329BFCF9E8DD295EE01", "scope": "Exact JSON bytes, including macro-fact author and corresponding PDF SHA-256. PhishDestroy is the integrity signer; original evidence attribution is unchanged." }, "pdf": { "filename": "steam_dossier_section_3_2_agent_ignatus.pdf", "sha256": "1fe6669d0eb91dbb3782e24bc8fc49f55752be21e350769b1e23be4543ee33b6", "pages": 4 } }