{ "compartment_id": "section-9", "number": "Section 9", "title_local": "Selective enforcement: the rulebook against the record", "title_english": "Selective enforcement: the rulebook against the record", "source_url": "https://phishdestroy.io/steam_dossier/#selective-enforcement", "source_document": "index.html", "content": { "html": "
\n
\n
\nPart B — Rules and enforcement record · Section 9\n

Their rulebook. The recorded platforms.

\n\n
Context & source limits

This ledger maps explicit clauses from the Steam Subscriber Agreement (SSA) and Steam Online Conduct (SOC) guidelines directly against active, large-scale commercial entities.

\n

The rule: no commercial use, no gambling, no bots — and Steam Support quotes those clauses when it refuses to return a victim's items. The record: the same clauses, on their face, cover the commercial platforms in this register, which run on Steam identities, Steam bots and Steam transfers. The clause is enforced against the person who lost the skins and not, on any published record, against the businesses moving them.

\n
\n

\n In the archived complaints, Steam Support cites the \"No Commercial Use\" and \"No Automation/Bots\" clauses when declining to restore items to victims of API-key fraud. The same clauses apply on their face to the commercial platforms recorded in this dossier, which authenticate through Steam OpenID and move items through automated Steam accounts. No market-wide revenue figure is estimated here (see the enforcement statistics below). What the record shows is the rule applied to individual accounts in the archived cases and no published per-operator enforcement record for the platforms. That asymmetry is what this section documents.\n

\n
\n
\n
The central question / selective enforcementRules → Scale → Accountability
\n

One rulebook. Unequal enforcement.

\n

The register shows commercial services using Steam identities, inventories, bots and transfers as operating infrastructure. The SSA prohibits commercial exploitation and automation without permission. The archived complaints show that rule applied to individual accounts, while the public record does not show an equivalent operator-by-operator account for the platforms documented here. Publish the rule, the evidence and the enforcement decision for each one.

\n
\n
189websites in audit scope
\n
44separate-domain routes in the live register — 27 with a published evidence file, 17 manually collected. The 189-website browser audit alone resolved 25 of them; the register adds the hand-collected routes.
\n
12 yr 6 mocsgogem.com blocked in the Link Filter; api.csgem.com registered 2014-03-08 and never blocked — one of 26 such pairs as of 2026-09-22
\n
No verified totalmarket-wide revenue estimate excluded
\n
\n
\n
\nSteam Online Conduct\n
\"…you shall not do, or attempt to do, any of the following on Steam: […] Engage in commercial activity. Examples of such prohibited behavior include: posting advertisements; running contests; gambling; buying or selling Steam accounts; selling content, gift cards, or other items; and begging.\"
\n

store.steampowered.com/online_conduct ↗ archived 2026-09-21 ↗

\n
\n
\nSSA § 2.G — Commercial use\n
\"…[you may not] exploit the Content and Services or any of its parts for any commercial purpose, except as expressly permitted elsewhere in this Agreement…\"
\n

Valve's 2016 notices, as reported, invoked the personal, non-commercial licence. No operator has produced a Valve authorisation on the record. store.steampowered.com/subscriber_agreement ↗ archived 2026-09-18 ↗

\n
\n
\nSteam Web API Terms of Use\n
\"You may not use the Steam Web API or Steam Data in any way that violates the Steam Subscriber Agreement.\"
\n

Third-party skin marketplaces operate through automated accounts consuming the Steam API. The rule text leaves no exception for commercial scale. steamcommunity.com/dev/apiterms ↗ archived 2026-09-21 ↗

\n
\n
\n
\n
SSA § 4.C

Automation

Scripts, bots and non-human interaction are restricted. The ledger records bot trading, account farms and automated routing at commercial scale.

Inspect the records tagged under this clause ↗
\n
SSA § 2.G

Commercial use

Commercial exploitation requires express permission. Compare the documented business models, their scale and any disclosed authorisation or enforcement.

Inspect the records tagged under this clause ↗
\n
SSA § 3.A

VPN & location disguise

Disguising residence through IP proxying can lead to termination. Separate-domain auth hosts require a separate analysis: establish what is disguised and which rule applies.

Inspect the auth-host evidence ↗
\n
Steam Help / URL policy

Link obfuscation

Steam prohibits link shorteners and tools that obscure link destinations. A separate auth domain — rbsnin.com in Rollbit's login flow, auth.dota.trade in CS.MONEY's — raises the comparable question of whether the destination shown to Steam's OpenID verifier identifies the operating site.

Valve's URL policy ↗
\n
\n

Rule references: Steam Subscriber Agreement, revision 10 September 2026 archived 2026-09-18 ↗ · Steam Web API Terms of Use archived 2026-09-21 ↗ · Steam URL policy (link obfuscation). Counts describe this dossier's records and tags; they are not a count of adjudicated violations.

\n
The trust deficit

Who reviews the decision when support closes the case?

The preserved complaints describe permanent sanctions, unanswered challenges and refusals to restore stolen items. Test those accounts against the actual ticket history, available remedies and account-access logs. A generic phishing explanation cannot establish who initiated a reset or created an API key.

Read the captured complaints ↗Request the underlying records →Moderator relationship graph →
\n
\n
\n
" }, "original_content_sha256": "7555a9dea9f54e44d2ae48916ea1d2d3c9c9baef4fd95b76957e0e23399324f8", "author_pseudonym": "Agent Lorraine", "schema": "phishdestroy.macro-fact.v1", "language": "en", "aggregator": "PhishDestroy", "exports": { "pdf": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_9_agent_lorraine.pdf", "json": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_9_agent_lorraine.json", "signature": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_9_agent_lorraine.json.asc" }, "integrity": { "signed_object": "steam_dossier_section_9_agent_lorraine.json", "signature_file": "steam_dossier_section_9_agent_lorraine.json.asc", "signing_key_fingerprint": "129FC7F39C40C69D2EF3C329BFCF9E8DD295EE01", "scope": "Exact JSON bytes, including macro-fact author and corresponding PDF SHA-256. PhishDestroy is the integrity signer; original evidence attribution is unchanged." }, "pdf": { "filename": "steam_dossier_section_9_agent_lorraine.pdf", "sha256": "53d7ae8be02fd97780e5b8245c37a950a6c75a5998c7a72ef39db2df1f248de7", "pages": 5 } }