{
  "schema": "phishdestroy.text-export.v1",
  "object_type": "Published page text and corresponding PDF digest",
  "id": "index.html",
  "language": "en",
  "title": "The Steam Dossier: rules, routes and accountability",
  "source_url": "https://phishdestroy.io/steam_dossier/index",
  "source_html_sha256": "d140c3c633f82f140a1eb581f6c0fee57f27ee8476b3fdaa0d057dda857bdf40",
  "exported_at": "2026-09-30T21:13:36.363Z",
  "scope": "Print reading edition. Research prose is retained; raster images and identified visual catalogues are replaced by source links. See editorial_scope for exact omissions. Support archive exports retain the core discussion and link the full gallery.",
  "editorial_scope": {
    "policy": "Research prose, conclusions, methodological limits and analytical tables retained without paragraph truncation. Named catalogues and visual galleries are linked; raster images are not embedded.",
    "linked_sections": [
      {
        "id": "exhibit-gallery-section",
        "source": "https://phishdestroy.io/steam_dossier/index#exhibit-gallery-section"
      }
    ],
    "raster_images_replaced": 2
  },
  "license": {
    "identifier": "CC0-1.0",
    "url": "https://creativecommons.org/publicdomain/zero/1.0/",
    "rights_statement_url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/license-rights.json",
    "rights_statement_sha256": "80d67354f8e5efd65b03696be950fb0f95c188d0089b1604281d0a4daff3f4cb",
    "application": "Authored research materials; third-party materials retain their own rights."
  },
  "pdf": {
    "filename": "index.pdf",
    "url": "https://phishdestroy.io/steam_dossier/exports/pages/en/index.pdf?v=print-20260930-links-v6",
    "sha256": "94dfc844fb1fb8aef41e8a6061e0c18c4eb18707ac8f360169ae4fdee83bd8ad",
    "bytes": 913452,
    "pages": 97
  },
  "integrity": {
    "signed_object": "index.content.json",
    "scope": "The exact UTF-8 bytes of this JSON file. It contains the published text and identifies the corresponding PDF by SHA-256. It is distinct from the separately signed rights statement.",
    "signature_file": "index.content.json.asc",
    "digest_file": "index.content.json.sha256",
    "format": "ASCII-armored detached OpenPGP",
    "signing_key_fingerprint": "129FC7F39C40C69D2EF3C329BFCF9E8DD295EE01",
    "public_key": "https://phishdestroy.io/.well-known/pgp-key.txt",
    "verify": [
      "gpg --import pgp-key.txt",
      "gpg --verify index.content.json.asc index.content.json",
      "sha256sum -c index.content.json.sha256"
    ]
  },
  "content": {
    "text": "Dieses Material ist auf Englisch verfügbar.Zurück zum Dossier · Deutsch ↗\nTL;DR — 5 VERIFIABLE CLAIMSAll 5 verifiable against Valve's own servers, documents and published dates\n44\n\nseparate auth-host domains found carrying Steam logins for third-party platforms — each a domain registered apart from the platform's main address.\n\nSection 3 →\n26\n\nfilter-split pairs: main domain shows a Steam Link Filter warning; the login host beside it does not.\n\nSection 3.2 →\n12y 6m\n\nis how long api.csgem.com has carried Steam logins while csgogem.com sits on the Link Filter. Registered March 2014.\n\nView table →\n10 days\n\nwas Valve's own 2016 deadline to gambling operators. No per-operator enforcement record has been published since.\n\nSection 2 →\n830 pp\n\nArt. 15 GDPR response from Valve's lawyers — 902,270 characters of extractable redactions, redaction bars left as selectable text.\n\nSection 18 →\nWHAT THIS MEANS — THE STEAM LINK FILTER\n\nValve maintains a link filter that blocks links to gambling and trading sites when posted in Steam chat or profile comments. When a user clicks a blocked link, Valve displays a full-screen warning: \"This link has been flagged as potentially malicious.\" However, Valve only checks the primary website domain. The separate domains used for Steam OpenID authentication are not on the blocklist — so the login flow succeeds even though the main site is blocked.\n\nSection 1 — Case briefing\nThe rule. The record. The unanswered questions.\nContext & source limits\n\nSix findings, each tied to a dated public record. The detailed sections follow the same order: technical record (Part A), rules and enforcement record (Part B), legal frameworks (Part C), then the appendices with the primary exhibits.\n\nSix findings. Each connects a written rule to a dated record and a question the evidence can test.\n\n1. Separate-domain auth hosts — 44 routes · 26 split pairs\n\nThe live register records 44 platforms authenticating through a separate registrable domain. Five further routes sit in pending verification awaiting an RDAP date; promoting them would take the total to 47. They are excluded from 44 and from the age chart. — 27 with a published per-route evidence file and 17 added from manual collection, listed apart. In 26 filter-split pairs the main domain is BLOCKED in the Steam Link Filter while the proxy carrying its login is not. These are not burner domains: csgogem.com is blocked while api.csgem.com, the host carrying its Steam login, has been registered since March 2014 — 12 years 6 months. Valve receives that hostname in every OpenID request, and renders it back to the user on its own login page. Full table, per-route ages and sourcing in Section 3.\n\nFollow the route →\n2. 2016: the mechanism was named, the deadline set\n\nOn 13 July 2016 Valve publicly described how gambling sites used Steam OpenID and automated trading accounts, and its counsel's notices of 20 July 2016 set a ten-day deadline. No per-operator enforcement record has been published since. Ten years after that deadline was issued, the same named mechanism is in use on separate-domain auth hosts that returned no Link Filter block on 2026-09-21.\n\nRead the open letter to the WSGC →\n3. Device correlation, on counsel's letterhead\n\nIn the correspondence reproduced here, Valve's counsel described device-level correlation linking one device to multiple accounts — a capability Steam Support had previously told users was not technically possible. The open question is which device-level records Valve holds and on what basis account holders are refused access to them.\n\nRead the memorandum →\n4. Two access responses. One withheld the data, one leaked it.\n\nOctober 2025: Valve's counsel answered an Art. 15 request with an 830-page appendix whose redactions are painted over the text instead of removing it — 902,270 characters come back out with a standard extraction tool, including the third-party identifiers the bars were there to withhold. Art. 15(4) is the reason those bars exist. September 2026: ticket HT-2YBP-F7JP-D4VB was closed after three days with a link to the self-service Account Data page — no data, no stated legal basis. The one-month period under Art. 12(3) had not expired at publication; the objection is to the substance.\n\nRead the redaction check →Read the ticket record →\n5. The market above Steam's ceiling\n\nSteam caps a Market listing at about $1,800. Across five marketplaces in a dated snapshot (23 Sep 2026), 248 CS2 item categories are priced above that cap by two or more of them independently, and all 248 are absent from Steam; a Factory New Dragon Lore starts at $10,941 across 389 copies listed on all five (the CSFloat-only figure in Section 13, from the 20 Sep snapshot, is $10,623.95 across 62 offers). Selling at those prices requires an outside venue, while item transfer still runs through Steam.\n\nFollow the price and transfer →\n6. The rule is explicit; the audit trail is not\n\nThe Subscriber Agreement reserves Steam for personal, non-commercial use, bars commercial exploitation except as expressly permitted, prohibits scripts and bots, and allows account termination. Valve applied that language to gambling operators in 2016. Separately, according to CSFloat's engineering account, Valve closed IEconItems_730/GetPlayerItems in 2017, removing public access to original item IDs (no Valve changelog located).\n\nPut the rule beside the network →\n2016 / Written demand 10 days\nDeadline in Valve counsel's July 2016 notices to gambling sites. Open letter to the WSGC: Section 2.\n2017 / Public audit trail ID access closed\nCSFloat records the loss of original item IDs.\nCounsel correspondence Device correlation\nOne device linked to dozens of stolen accounts.\nRoute register Blocked, and still logging in\nThe rule: Valve's 2016 statement prohibits running a gambling business on Steam OpenID. The record: 26 main domains sit on the Link Filter while the host carrying each one's Steam login runs on — csgogem.com's has run 12 years 6 months.\nSection 2 — Open letter\nOpen letter to the Washington State Gambling Commission\n\nTen days became ten years. The Commission's 2016 question to Valve has not been answered with an operator-by-operator record; this letter asks it to reopen the file.\n\nPUBLIC ADDRESS · WASHINGTON STATE GAMBLING COMMISSION\n\nTen days became ten years.Reopen the record.\n\nTo the Washington State Gambling Commission:\n\nIn 2016, Director David Trujillo asked Valve to show what it had done to stop the use of Steam skins for gambling. Then-Chair Chris Stearns and the Commission confronted an industry built on Valve-issued items and Steam transfers. Both men have since left their Commission roles. The question they put to Valve has not expired.\n\nValve's general counsel, Karl Quackenbush, gave gambling operators ten days to stop commercial use of Steam accounts. In its October response to your Commission, Valve denied facilitating gambling, said it had sent cease-and-desist letters to more than forty sites and said it had disabled associated accounts. It also defended preserving Steam trading and OpenID because those services benefited customers and game developers. That was an assertion of control. It deserves a test, not deference.\n\nIn our assessment, Valve's answer did not demonstrate that its chosen enforcement matched the scale of the network it described. A threatening letter to an operator is not the same thing as a durable block on the Steam accounts, trading infrastructure and authentication routes that make the business work. Reported estimates put CS:GO Lounge alone above $1 billion in betting handle during 2016; that is an outside estimate of wagers, not Valve revenue, and the site's original skin-betting operation later shut down. The scale made verifiable enforcement essential.\n\nToday, Valve's own Subscriber Agreement archived 2026-09-21 ↗ restricts commercial exploitation except where expressly permitted and separately prohibits specified forms of automation. Our dated route register records declared OpenID return hosts for outside services; openid.realm and openid.return_to are fields sent to Steam, not secrets hidden from it. Our Link Filter checks show cases where a main address was warned against but an associated login host was not. A filter result alone cannot prove that Valve allowed a login or that a particular bot evaded an account ban. It does prove that a homepage warning cannot be offered as a complete answer about access.\n\nNor can the existence of useful, lawful Steam trading and OpenID functions answer whether prohibited operators were actually excluded. Valve's own rules allow express exceptions. If Valve relies on that distinction, the Commission should ask it to identify the authorisation, account controls and enforcement criteria applicable to commercial skin businesses, and the specific non-gambling uses it invoked in 2016. The mere possibility of lawful use is no answer to documented prohibited use.\n\nWe ask the Commission to revisit its 2016 file and request an operator-by-operator account: which Steam accounts and trading bots were disabled after the ten-day notices; whether related accounts or return hosts were monitored; which operators later regained access; what exemptions were granted; and what records support Valve's statement to the Commission. Publish what law allows the public to inspect. Compare those records with current routes and with Valve's later interventions, including OPSkins in 2018 archived 2026-03-07 ↗.\n\nThe notice set a ten-day deadline in July 2016; ten years is long enough to establish whether it was carried out. The Commission should test Valve's 2016 account against the infrastructure that remains observable today.\n\nThe Steam Dossier investigation · Public statement, 20 September 2026\n\n2016 Commission notice ↗ archived 2026-05-20 ↗ · Valve's 2016 reply (document copy) ↗ · Valve's 2016 OpenID statement ↗ archived 2026-09-21 ↗ · Current Steam agreement ↗ archived 2026-09-21 ↗ · Timeline of the 2016 exchange: Section 11 →\n\nPart A — Technical record · Section 3\nThe site is blocked. The login route is not.\n\n26 blocked main domains. The authentication proxy behind each one, and how long it has been alive. These separate auth hosts are not incidental second addresses — each one is an authentication proxy for Steam, standing between the platform and Valve's OpenID endpoint and carrying the login the blocked domain can no longer carry in the open. Valve put the front door on the Link Filter. The sign-in kept running through the proxy: csgogem.com is blocked, and api.csgem.com has been registered since March 2014 — twelve and a half years. Every one of those days that host sent its own hostname to Valve's OpenID endpoint, and Steam rendered it straight back to the user on the login page. Valve is the trunk every one of these routes runs through; it does not have to find them. That is what this section measures: not whether a warning exists, but how many years the route behind the warning stays open. 44 separate-domain routes in the register, 27 of them with a published per-route evidence file — the table below. Follow one example, then measure all of them.\n\nFigure 3.1 — The two routes, drawn.\n\nOne platform, one player, two requests leaving the same browser. Valve's Link Filter stands on both. It stops the one that carries a link and passes the one that carries the login. Everything measured in this section is a count of how long the lower route stays open.\n\nThe player\none browser, one session\nrollbit.com\nthe platform's main domain\nrbsnin.com\nseparate authentication host\nLINK FILTER\n✕ BLOCKED\nLINK FILTER\n✓ CLEAN\nsteamcommunity.com\nOpenID endpoint · signs in\nno route\nLink posted in Steam — stoppedLogin request — passesSaved checks of 19 and 21 September 2026\n\nBoth requests are visible to Valve, and only one is acted on. The Link Filter is a Valve list, checked by a Valve service. The OpenID request carries the auth host's own name to Valve's endpoint, which prints it straight back on the login page. The hostname is in the request either way — what differs is whether anything is done with it.\n\nOne platform. Two different routes.ROLLBIT / SAVED OBSERVATIONS\nStep 5 / 5\n\nThe request reaches Steam. The observed route reached Steam's login form. The authors did not complete the login. Blocking the main-domain link did not block this observed route to the form.\n\n01 THE LINK FILTER CHECK\nDESTINATIONrollbit.comThe platform's main domain\nSTEAM LINK FILTERChecks the linkA separate destination-warning system\nSAVED RESULTLink blocked19 & 21 September 2026\n02 THE OBSERVED SIGN-IN ROUTE\nON THE PLATFORMSign in with SteamThe platform starts an OpenID request\nSEPARATE AUTH HOSTrbsnin.comNo Link Filter block in the saved check\nSTEAMLogin form servedThe requested host appears in Steam's notice\nInspect the original capture notes, registration date and protocol details\nWhat Valve's enforcement looks like\nMain domain: blocked\nUser\n→\nrollbit.com\n(main domain)\n↓\nSTEAM LINK FILTER — BLOCKED\n\"Link Blocked!\" — flagged as potentially malicious\nrollbit.com returned a Link Filter block on 2026-09-19 and 2026-09-21 (unauthenticated check; raw HTML and SHA-256 saved). A visible, auditable record.\nWhat actually happens — authentication\nAuth host: not blocked\nUser\n→\nrollbit.com\n\"Sign in with Steam\"\n↓\nRedirect via separate auth host:\nrbsnin.comLink Filter: CLEAN\nregistered 2026-09-18T09:34:52Z (Verisign RDAP)\n↓\nSteam login page notice (2026-09-20):\n\"Note that rbsnin.com is not affiliated with Steam or Valve\"\nSteam renders this notice from the openid.realm of the request it received.\n↓\nSteam login form served for the separate host\nThe login was not completed by the authors; the flow was observed up to the Steam form.\nValve receives the return_to / realm hostname on every such request. rbsnin.com returned no Link Filter block on 2026-09-21.\nPer request\nAs the OpenID provider, Steam receives the auth hostname with every authentication request: it arrives at Valve's own servers in the openid.return_to and openid.realm parameters.\nSent by the site\nThe auth host is not discovered by scanning — the platform sends it to Steam in each request. Under OpenID 2.0 §9.1 return_to is formally optional, but without it Steam cannot deliver the login result, so for a working Steam login it is effectively required. Steam even renders the hostname to the user (\"<host> is not affiliated with Steam or Valve\").\n14 yr\nis the age of the oldest auth host still carrying Steam logins at the 2026-09-21 check (dota2.net, registered 2011-10-29); the newest is three days old (rbsnin.com). Do not read the \"0 auth hosts blocked\" figure as the finding. A blocked auth host would break the platform's \"Sign in with Steam\" outright, so a register built from working logins can only contain hosts that were never blocked. The number that carries meaning is not the block count — it is how many years the main domain sat on the Link Filter while the login beside it kept running.\nSeparate-domain auth hosts: registration date vs. main domain (30 routes: the 25 resolved in the 2026-09-21 browser audit, plus 5 added on 2026-09-22)\nPlatform\tLink Filter: main\tAuth host\tLink Filter: auth host\tAuth host registered\tSource of observation\tEvidence file\nRollbit\nrollbit.com · reg. 2014-11-08\n\tBLOCKED\n2026-09-19, 2026-09-21 · Wayback 2026-09-21\n\trbsnin.com\tCLEAN\n2026-09-21 · raw HTML (no Wayback snapshot)\n\t2026-09-18\n09:34:52Z, Verisign RDAP\n\tSteam login-page notice, 2026-09-20\trollbit.com.json\nSkin.Club\nskin.club · reg. 2017-09-04\n\tBLOCKED\n2026-09-19, 2026-09-21 · Wayback 2026-09-21\n\tsc-auth.net\tCLEAN\n2026-09-21 · Wayback 2026-09-21\n\t2019-04-02\nRDAP\n\tSteam login-page notice\tskin.club.json\nHowl.GG\nhowl.gg · reg. 2017-03-16\n\tBLOCKED\n2026-09-18, 09-19, 09-21 · Wayback 2026-09-21\n\thowl.uno\tCLEAN\n2026-09-21 · Wayback 2026-09-21\n\t2026-08-11\nRDAP\n\tLive browser capture + supplied OpenID URL\thowl.gg.json\nDuelbits\nduelbits.com · reg. 2020-02-03\n\tBLOCKED\n2026-09-21 · Wayback 2026-09-21\n\tswitchflips.com\tCLEAN\n2026-09-21 · Wayback 2026-09-21\n\t2020-04-21\nRDAP\n\tSupplied OpenID URL\tduelbits.com.json\nCSGOFast\ncsgofast.com · reg. 2015-03-27\n\tBLOCKED\n2026-09-19, 2026-09-21 · Wayback 2026-09-21\n\tsteam-login.authtofast.com\tCLEAN\nauthtofast.com, 2026-09-21 · Wayback 2026-09-21\n\t2026-06-30\nauthtofast.com, RDAP\n\tLive browser capture + supplied OpenID URL\tcsgofast.com.json\nFarmskins\nfarmskins.com · reg. 2016-03-23\n\tBLOCKED\n2026-09-19, 2026-09-21 · raw HTML\n\tsteam.kobal.cc\tCLEAN\n2026-09-19, 2026-09-21 · raw HTML\n\t2017-01-07\nkobal.cc, RDAP\n\tLive browser capture + supplied OpenID URL\tfarmskins.com.json\nCobaltLab\ncobaltlab.tech\n\tBLOCKED\n2026-09-21 · raw HTML\n\tcobaltauth.com\tCLEAN\n2026-09-21 · raw HTML\n\t2025-01-07\nRDAP\n\tSupplied OpenID URL\tcobaltlab.tech.json\nCSGO.NET\ncsgo.net · reg. 2012-07-22\n\tBLOCKED\n2026-09-21 · raw HTML\n\tcn2.easylot.net\tCLEAN\n2026-09-21 · raw HTML\n\t2016-09-03\neasylot.net, RDAP\n\tLive browser capture\tcsgo.net.json\nGGDrop\nggdrop.com\n\tBLOCKED\n2026-09-21 · raw HTML\n\tggauth.com\tCLEAN\n2026-09-21 · raw HTML\n\t2023-05-03\nRDAP\n\tSupplied OpenID URL\tggdrop.com.json\nRustChance\nrustchance.com\n\tBLOCKED\n2026-09-21 · raw HTML\n\thgfuihd.com\tCLEAN\n2026-09-21 · raw HTML\n\t2019-01-27\nRDAP\n\tSupplied OpenID URL\trustchance.com.json\nSkin.Fans\nskin.fans\n\tBLOCKED\n2026-09-21 · raw HTML\n\tauth.skinfans.com\tCLEAN\n2026-09-21 · raw HTML\n\t2018-07-16\nskinfans.com, RDAP\n\tSupplied OpenID URL\tskin.fans.json\nSkinport\nskinport.com · reg. 2018-09-05\n\tBLOCKED\n2026-09-21 · raw HTML\n\tskinport.app\tCLEAN\n2026-09-21 · raw HTML\n\t2020-06-20\nRDAP\n\tLive browser capture + supplied OpenID URL\tskinport.com.json\nSkins.Cash\nskins.cash\n\tBLOCKED\n2026-09-21 · raw HTML\n\tskinscash.live\tCLEAN\n2026-09-21 · raw HTML\n\t2019-12-05\nRDAP\n\tSupplied OpenID URL\tskins.cash.json\nTF2Hunt\ntf2hunt.com · reg. 2018-01-13\n\tBLOCKED\n2026-09-21 · raw HTML\n\trstspcl.com\tCLEAN\n2026-09-21 · raw HTML\n\t2020-08-08\nRDAP\n\tLive browser capture + supplied OpenID URL\ttf2hunt.com.json\nCSGOGem\ncsgogem.com · reg. 2016-10-16\n\tBLOCKED\n2026-09-22 · raw HTML\n\tapi.csgem.com\ncsgem.com — separate registrable domain\n\tCLEAN\n2026-09-22 · raw HTML\n\t2014-03-08\ncsgem.com, RDAP — oldest in register\n\tManual collection + Link Filter capture\tlinkfilter-2026-09-22.json\nGamdom\ngamdom.com · reg. 2016-07-29\n\tBLOCKED\n2026-09-22 · raw HTML\n\tlogin.gambldom.com\ngambldom.com — one letter off the brand\n\tCLEAN\n2026-09-22 · raw HTML\n\t2017-09-24\ngambldom.com, RDAP\n\tManual collection + Link Filter capture\tlinkfilter-2026-09-22.json\n12CS\n12cs.fail · reg. 2026-03-24\n\tBLOCKED\n2026-09-22 · raw HTML\n\tfail.games\tCLEAN\n2026-09-22 · raw HTML\n\t2021-08-24\nfail.games, RDAP\n\tManual collection + Link Filter capture\tlinkfilter-2026-09-22.json\nCSGOEmpire\ncsgoempire.com · reg. 2015-06-10\n\tCLEAN\n2026-09-19, 2026-09-21 · Wayback 2026-09-21\n\tcsgoempirelogin4.com\none of ten numbered domains login1–10\n\tCLEAN\n2026-09-21 · Wayback 2026-09-21\n\t2020-07-20\n05:49:17Z, Verisign RDAP\n\tLive browser capture\tcsgoempire.com.json\nCS.MONEY\ncs.money\n\tCLEAN\n2026-09-21 · raw HTML\n\tauth.dota.trade\tCLEAN\n2026-09-21 · raw HTML\n\t2016-07-15\ndota.trade, RDAP\n\tSteam login-page notice\tcs.money.json\nCSFloat\ncsfloat.com · reg. 2021-07-11\n\tCLEAN\n2026-09-21 · raw HTML\n\tcsgofloat.com\noperator's former brand domain; separate registrable domain, not an evasion indicator\n\tCLEAN\n2026-09-21 · raw HTML\n\t2015-09-29\nRDAP\n\tLive browser capture\tcsfloat.com.json\nG4Skins\ng4skins.com\n\tCLEAN\n2026-09-21 · raw HTML\n\tauth.g4s.to\tCLEAN\n2026-09-21 · raw HTML\n\t2021-05-30\ng4s.to, RDAP\n\tSupplied OpenID URL\tg4skins.com.json\nJuice.GG\njuice.gg\n\tCLEAN\n2026-09-21 · raw HTML\n\tletmeinjuice.com\tCLEAN\n2026-09-21 · raw HTML\n\t2024-04-15\nRDAP\n\tSupplied OpenID URL\tjuice.gg.json\nMarket.CSGO\nmarket.csgo.com\n\tCLEAN\n2026-09-21 · raw HTML\n\tdota2.net\tCLEAN\n2026-09-21 · raw HTML\n\t2011-10-29\nRDAP\n\tLive browser capture + supplied OpenID URL\tmarket.csgo.com.json\nRust.TM\nrust.tm\n\tCLEAN\n2026-09-21 · raw HTML\n\tdota2.net\tCLEAN\n2026-09-21 · raw HTML\n\t2011-10-29\nRDAP\n\tSupplied OpenID URL\trust.tm.json\nCSGOLounge\ncsgolounge.com · reg. 2013-08-14\n\tCLEAN\n2026-09-22 · raw HTML\n\tdota2.net\nthird front-end on this auth host\n\tCLEAN\n2026-09-22 · raw HTML\n\t2011-10-29\ndota2.net, RDAP\n\tManual collection + Link Filter capture\tlinkfilter-2026-09-22.json\nDota2Lounge\ndota2lounge.com · reg. 2012-08-10\n\tCLEAN\n2026-09-22 · raw HTML\n\tdota2.net\nfourth front-end on this auth host\n\tCLEAN\n2026-09-22 · raw HTML\n\t2011-10-29\ndota2.net, RDAP\n\tManual collection + Link Filter capture\tlinkfilter-2026-09-22.json\nSkinBaron\nskinbaron.de\n\tCLEAN\n2026-09-21 · raw HTML\n\tskinbaron.com\nsame brand, different TLD\n\tCLEAN\n2026-09-21 · raw HTML\n\t2015-12-22\nRDAP\n\tSupplied OpenID URL\tskinbaron.de.json\nTF2Royal\ntf2royal.com · reg. 2022-08-17\n\tCLEAN\n2026-09-21 · raw HTML\n\ttf2auth.com\tCLEAN\n2026-09-21 · raw HTML\n\t2021-07-27\nRDAP\n\tLive browser capture + supplied OpenID URL\ttf2royal.com.json\nTradeit\ntradeit.gg\n\tCLEAN\n2026-09-21 · raw HTML\n\tconnect-tradeit.com\tCLEAN\n2026-09-21 · raw HTML\n\t2022-02-23\nRDAP\n\tSupplied OpenID URL\ttradeit.gg.json\nUpgrader\nupgrader.pro\n\tCLEAN\n2026-09-21 · raw HTML\n\tupgauth.space\tCLEAN\n2026-09-21 · raw HTML\n\t2026-08-14\nRDAP\n\tSupplied OpenID URL\tupgrader.pro.json\nSource: steamcommunity.com/linkfilter, unauthenticated GET, 2026-09-21, 53 hosts, 3 s spacing; steam_tos_assets/linkfilter-recheck-2026-09-21.json; raw HTML in steam_tos_assets/linkfilter-raw/. Registration dates: RDAP, steam_tos_assets/domain-registration.json. · Earlier check of 2026-09-19 in linkfilter-all-results.json · route records in auth-route-audit.json · Wayback Machine snapshots of the Link Filter pages, 2026-09-21, listed in wayback-snapshots.json (no snapshot exists for rbsnin.com; the local raw file is the only record).\n\nRegistration dates: RDAP (steam_tos_assets/domain-registry/). \"Supplied OpenID URL\" establishes the request parameters, not a completed login. No login was completed by the authors on any platform. A separate domain is not by itself proof of evasion. Nor is \"0 auth hosts blocked\" an independent finding: blocking one would break that platform's Steam login, so a register assembled from working logins cannot contain a blocked auth host. The observation that carries weight is the pairing and its duration — a main domain on the Link Filter beside a login domain that has run for years. This table carries 30 rows: 25 of the 27 routes with a per-route evidence file, plus five added on 2026-09-22 whose Link Filter split is captured in linkfilter-2026-09-22.json even though the realm itself was hand-collected — their rows say so in the source column. The two evidence-file routes not shown are skinsnipe.com (auth host pricing.tradeupspy.com, registered 2020-03-11) and csgobig.com (auth host letmeinbig.com, registered 2023-01-20); both returned BLOCKED main / CLEAN auth host in the check of 2026-09-22, recorded with SHA-256 in linkfilter-2026-09-22c.json, but the raw HTML for that batch is not in the published set, so they are named here rather than given a row that every other line in this table can evidence. The remaining 12 hand-collected routes in the register are identified as such in master_registry.json under realm_src: user.\n\nPrimary Empirical Audit · Multi-Year Date Range\nThe Big Picture Trap: Link Filter is Compliance Theater, Not a Shield\n\nOn desktop browsers, users are shielded by external defenses: Google Safe Browsing and Microsoft SmartScreen intercept known phishing with full-screen red warnings. Inside Steam's Big Picture mode, the in-game overlay (Shift+Tab), and the Steam Deck (SteamOS), those defenses do not exist. The embedded browser supports zero extensions, disables external Safe Browsing engines, and leaves the user with exactly one defensive barrier: Valve's linkfilter interstitial.\n\nSwipe to compare all four results →\n\n92.5%\n2025–2026 modern edge phishing passed clean (37/40)\n77.5%\n2023–2024 CS2 era phishing passed clean (31/40)\n70.0%\n2021–2022 legacy phishing passed clean (28/40)\n7 / 7\ngambling mains blocked (positive control)\nMulti-Year Longitudinal Audit: 120 Pure Steam Phishing Domains Tested Live (24 Sep 2026)\n\nTo test whether Valve's filter is simply slow to ingest new threats or fundamentally blind to them, we audited 120 confirmed Steam-specific phishing domains across three historical cohorts against steamcommunity.com/linkfilter:\n\nCohort 1: 2021–2022 (Classic Trade-Offer & Item Drops) — 70.0% Clean Pass (28/40). Even 4 to 5 years after being cataloged by community watchdogs, 7 out of 10 legacy phishing hosts still open without any block.\nCohort 2: 2023–2024 (CS2 Beta Hype & Fake Support Appeals) — 77.5% Clean Pass (31/40). Campaigns impersonating Counter-Strike 2 releases and fake community appeals (e.g. cs2-steam.com, appealsteamcommunity.help) pass straight through.\nCohort 3: 2025–2026 (Serverless Edge Deploys & Favicon Clones) — 92.5% Clean Pass (37/40). Modern phishing kits deploying on EdgeOne, Vercel, and Cloudflare Pages (e.g. steamgifter.online, steam-dp4lt5b8fnez.edgeone.dev) pass virtually unobstructed.\n\nTelemetry & Liability Shield, Not Protection. Why does the Link Filter exist if it passes 70% to 92.5% of pure Steam phishing? It functions as a corporate liability disclaimer and an outbound click telemetry sensor. By presenting a polite \"You are leaving Steam\" notice with a clickable green proceed button, Valve shifts legal blame onto the victim under the Steam Subscriber Agreement (*\"the user voluntarily navigated outside Steam\"*). Valve collects the telemetry of the click, but does not block the theft.\n\nThe Favicon Hash Proof: Zero Ingestion of Threat Feeds. Independent threat intelligence platforms (urlscan.io, Shodan, Censys) identify live Steam phishing kits using a simple search for Steam's official favicon hash (page.favicon.hash:9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad NOT domain:*.steampowered.com). This basic automated check surfaces active phishing clusters in seconds. Valve does not sync with external feeds, does not run hash-based threat hunting, and only manually intervenes when compelled by regulators (the 2016 WSGC gambling order) or to protect its trademarked domain strings.\n\nPrimary audit evidence artifacts: Longitudinal 120-domain multi-year audit: longitudinal-steam-phishing-audit.json · 100 dedicated Steam phishing sample: linkfilter-steam-phishing-100.json · Broad feed audit (n=250): linkfilter-coverage-2026-09-22.json.\n\nCSGOEmpire — batch registration of ten numbered auth domains\n\nOn 2020-07-20 ten numbered domains, csgoempirelogin1.com through csgoempirelogin10.com, were registered. Verisign RDAP timestamps are on file for all ten: login1 05:49:06Z, login5 05:49:08Z, login2 05:49:11Z, login3 05:49:14Z, login4 05:49:17Z, login6 05:49:20Z, login7 05:49:23Z, login8 05:49:26Z, login9 05:49:28Z — nine domains in 22 seconds — and login10 at 05:56:03Z, seven minutes later. The spacing is consistent with a single registrar bulk operation.\n\nThe pattern is consistent with pre-provisioned fallback hosts; only login4 has been observed in a live OpenID request. csgoempire.com and csgoempirelogin4.com both returned CLEAN in the Link Filter on 2026-09-21; CSGOEmpire was not among the sites named in press reports of the July 2016 notices.\n\n# DNS — all 10 active (September 2026)\nOK csgoempirelogin1.com 172.67.129.43\nOK csgoempirelogin2.com 172.67.175.168\nOK csgoempirelogin3.com 188.114.96.3\nOK csgoempirelogin4.com 188.114.96.11 ← in OpenID traffic\nOK csgoempirelogin5.com 172.67.160.194\nOK csgoempirelogin6–10.com Cloudflare IPs\nNXDOMAIN: csgoempirelogin11.com\nAll 10 registered 2020-07-20; all 10 RDAP-timestamped (steam_tos_assets/domain-registry/csgoempireloginN.com.rdap.json)\nConclusion for regulators\nA blocked main domain paired with an unblocked auth host leaves the login route open — and it stays open for years.\n\nThe Link Filter block on the main domain is a verifiable, public record. The auth host carries the \"Sign in with Steam\" traffic and appears in Valve's own OpenID request parameters. Across checks on 2026-09-21 and 2026-09-22, in 26 filter-split pairs the main domain returned a Link Filter block while the proxy carrying its login returned none. The register above measures the other half of that: these hosts are not short-lived burner domains. Several had been registered for more than a decade at the date of the check, and every one of those days is a day on which Valve received the hostname in its own request parameters. Valve has published no per-operator enforcement record, so whether any other measure was applied to these hosts cannot be established from public data.\n\n12 yr 6 mo\ncsgogem.com is blocked in the Link Filter.\nIts login host api.csgem.com has been\nregistered since 2014-03-08 and is not.\nPlain Language Summary — For Regulators & Courts (expand)\nPlain language summary — for regulators\nBackground: What Steam Is and Why It Matters Here\n\nSteam is a software platform operated by Valve Corporation (Bellevue, Washington, USA). Steam functions as a digital identity provider: gambling and gaming websites across the internet use a system called \"Sign in with Steam\" — a button that allows a website to verify that a visitor has a real Steam account. This is similar to \"Sign in with Google\" or a government-issued identity card check: the website sends the user to Steam's servers, Steam confirms who they are, and Steam sends them back to the website. Valve operates the authentication system. Every single login through \"Sign in with Steam\" passes through Valve's own servers.\n\nWhat Valve Did: The Domain Block\n\nIn July 2016, following media and legal pressure over skin gambling, Valve's counsel sent notices to approximately 23 named gambling sites (per press reports of 21 July 2016); in October 2016 Valve told the Washington State Gambling Commission it had contacted more than forty sites. Some gambling domains appear in the Steam Link Filter — a list that makes any link to them posted inside Steam (in chat, on a profile page, in the store) show a warning page: \"Link Blocked!\" The Link Filter is the only enforcement measure whose effect can be observed from outside Valve.\n\nExample: A link to rollbit.com inside Steam produces the Link Filter warning page (checked 2026-09-19 and 2026-09-21). On paper, the gambling site is blocked.\nWhat a Proxy Domain Is\n\nA separate-domain auth host is an authentication proxy: a second website address, on a different registrable domain, that the same operator puts between its users and Steam for the sole purpose of carrying the \"Sign in with Steam\" step. It proxies the login. The user believes they are signing in to the platform; the request that reaches Valve carries the proxy's hostname, not the platform's. It usually has no publicly visible connection to the gambling site, and it is the address that receives users back after Steam confirms their identity.\n\nExample: Rollbit operates under rollbit.com, which the Link Filter blocks. For Steam authentication, the flow observed on 2026-09-20 used a separate address: rbsnin.com, registered 2026-09-18. This address returned no Link Filter block on 2026-09-21. The gambling site continued to operate, and its Steam login flow ran through the unblocked host.\nThe Critical Point: The Auth Host Is Sent to Steam in Every Request\n\nValve does not need to scan or crawl to learn which auth hosts are in use. Steam is the OpenID identity provider for these sites, and every \"Sign in with Steam\" click sends a GET request to Valve's own servers containing the auth hostname in plaintext. Under OpenID 2.0 §9.1 the return_to field is formally optional, but without it Steam cannot deliver the login result, so for a working Steam login it is effectively required. Steam itself renders the hostname on the login page (\"<host> is not affiliated with Steam or Valve\").\n\n— Shape of the request Steam receives (host as observed for Rollbit on 2026-09-20): —\nGET steamcommunity.com/openid/login\n&openid.mode=checkid_setup\n&openid.return_to=https://rbsnin.com/… ← effectively required; arrives in Valve's log\n&openid.realm=https://rbsnin.com ← self-declared by the site; rendered on Steam's login page\nIf the site uses server-to-server verification (check_authentication), Valve's log also records the platform's server IP and hosting network.\n\nExtracting the hostname from this request is a standard operation. The enforcement record — which hosts were acted on, which were not, and under what criteria — exists only in Valve's infrastructure and has not been published.\n\nWhat This Proves\n\n1. The Link Filter block acts on links, not on logins. Blocking the main domain (for example rollbit.com) shows a warning to users who click links to it inside Steam. It does not stop the site from operating, or from using Valve's own OpenID service through a different address.\n\n2. The auth hosts tested were not blocked. The table above shows separate-domain auth hosts registered between 2011 and September 2026, several of them years after the July 2016 notices. In 26 pairs the main domain returned a Link Filter block and the proxy carrying its login did not (unauthenticated checks, 2026-09-21 and 2026-09-22; raw responses and SHA-256 saved). That proxy would stop working the day Valve refused it, which is why the measure here is how long it has run, not whether it is listed. Valve receives these hostnames in its own OpenID requests. Whether any measure other than the Link Filter was applied cannot be determined from public data, because Valve has published no per-operator enforcement record.\n\n3. The sites continued to authenticate through Valve's infrastructure. \"Sign in with Steam\" is Valve's service; every authentication through it is a request Valve receives and processes. Valve also earns revenue from case keys, and the Steam Community Market charges a combined fee of about 15% on transactions completed inside the Market (not on external trades). The Link Filter action created a public record; it did not interrupt the authentication relationship.\n\nWould Blocking Have Worked?\n\nBy analogy: when the free domain registrar Freenom wound down in 2023, phishing campaigns that depended on its domains were disrupted. Operational continuity depends on infrastructure stability.\n\nThe same logic applies here. If an auth host were refused in Steam's OpenID processing, the platform's \"Sign in with Steam\" function would break until a new host is registered, certificates issued and DNS propagated. During that window: downtime.\n\nRotation does not make blocking futile. It makes blocking an operational cost. Since new hosts appear in Valve's own request logs on first use, a response could run at the speed of that first use.\n\nBatch registration is itself a signal: CSGOEmpire's login1–login10 were registered on 2020-07-20, nine of them within 22 seconds (Verisign RDAP). A response does not need to be domain-by-domain; a sequential series from one registrar session can be identified as a series.\n\nThe public record does not show an attempt to block auth hosts that was defeated by rotation.\nIt shows main domains blocked while the proxy carrying each login kept running — 26 pairs as of 2026-09-22, the oldest auth host registered 12 years 6 months — and no published enforcement record for any operator.\nThe question for the regulator is therefore: what enforcement, if any, has Valve applied to the auth hosts it receives in its own OpenID requests?\nWhat Valve Did — and Why It Did Not Interrupt the Auth Path\n\nThe table below maps each publicly documented Valve action against whether it affected the OpenID authentication entry point. The finding is not \"Valve did nothing\" — it is that none of the publicly documented actions touched the point where gambling-platform logins pass through Valve's servers.\n\nDate\tValve Action\tAffected openid.return_to path?\nJuly 2016\tPublic statement of 13 July 2016; counsel's notices to ~23 named sites (press, 21 July 2016); >40 sites contacted per Valve's October 2016 letter to WSGC\tNo. Notices and the Link Filter act on operators and links; the OpenID request path was not changed.\n2017\tClosure of IEconItems_730/GetPlayerItems (according to CSFloat's engineering account; no Valve changelog located)\tNo. Affected public item-history visibility. OpenID authentication was not modified.\n2018-03-29\tCS:GO 7-day trade lock announced (blog.counter-strike.net)\tNo. Slowed item movement; the OpenID request path was not changed.\n2022-05-10\tTrade-cancellation endpoints removed from the public Web API (user-detected; no Valve changelog — node-steam-tradeoffer-manager #325)\tNo. Closed the offer-swap tooling; OpenID authentication was not modified.\n2023-12-04\tAPI-key creation now requires mobile confirmation (steamcommunity.com/dev/apikey; no changelog)\tNo. Protected the key endpoint; the auth hosts documented here were not affected.\n2026-09-19 / 09-21\tSteam Link Filter state as observed by the authors\tNo. 14 main domains returned a block in the saved 2026-09-21 recheck — 26 split pairs in the register by 2026-09-22 — while the proxy carrying each login kept running.\nSources: Valve statement of 13 July 2016 (store.steampowered.com/oldnews/22883, archived 2026-09-21) · CSFloat engineering account of the 2017 closure (blog.csfloat.com, archived 2026-09-21) · Link Filter state: linkfilter-recheck-2026-09-21.json.\nThis finding is falsifiable by a single published instance in which Valve refused an OpenID request because openid.return_to pointed to a gambling auth host. No such instance has been located in the public record.\nThe two most recent auth-host registrations\nhowl.unowas registered 2026-08-11 (RDAP), 41 days before 2026-09-21; howl.gg returned a Link Filter block on 2026-09-18, 2026-09-19 and 2026-09-21. Whether the block preceded the registration is not established.\nrbsnin.comwas registered 2026-09-18T09:34:52Z (Verisign RDAP) and was observed in Rollbit's Steam login flow on 2026-09-20 via Steam's own login-page notice; rollbit.com returned a Link Filter block on 2026-09-19 and 2026-09-21, rbsnin.com did not.\nEach host in the table above is sent to Valve's authentication servers as openid.realm on every login attempt.\nFull per-route data and Link Filter verdicts: the table in Section 3 above; raw results in linkfilter-recheck-2026-09-21.json and linkfilter-all-results.json.\nMethodology — How the Route and Link Filter Counts Were Established\n1. Domain resolution\nThe 2026-09-21 audit resolved 78 of 189 requested platforms: 33 authenticate on their own hostname and 20 on their own subdomain — direct authentication, and none of them are counted as separate-domain routes. The remaining 25 authenticate through a separate registrable domain, across 24 distinct hostnames (dota2.net is shared by market.csgo.com and rust.tm): 10 established by live browser capture, 3 by Steam's own login-page notice, 12 by a supplied OpenID URL. The live register (master_registry.json, 2026-09-22) extends that to 44 separate-domain routes: 26 filter-split pairs (main domain BLOCKED, auth host CLEAN) plus 18 further routes without a main-domain split. Of the 44, 27 carry a per-route evidence file; the other 17 were collected by hand and are marked realm_src: user in the register. Five of those seventeen — csgogem.com, gamdom.com, 12cs.fail, csgolounge.com and dota2lounge.com — were added on 2026-09-22 with a Link Filter capture of both hosts (raw HTML + SHA-256 in linkfilter-2026-09-22.json), so the split itself is evidenced even though the realm is hand-collected; they appear in the table above alongside the evidence-file routes. tfauth.com (tf2easy.com) was dropped from the register on 2026-09-22: like arena.fragnet.net, nothing verifiable links it to its origin site. The count is re-derivable from the published auth-route-audit.json (run of 2026-09-21) by one rule: a platform counts only when its observed Steam OpenID host sits on a different registrable domain than the platform itself.\n2. Steam Link Filter status\nTested via steamcommunity.com/linkfilter/?url=https://[domain], unauthenticated, on 2026-09-19 and 2026-09-21; raw HTML saved with SHA-256. Status recorded for main domain and auth host separately. A classifier distinguishes the generic \"You are leaving Steam\" notice (CLEAN) from the \"Link Blocked! ... flagged as potentially malicious\" page (BLOCKED); a google.com control confirms the two are not conflated. An earlier authenticated variant of this test was discarded after it returned \"blocked\" for every domain including that control — traced to an invalid session cookie in the probe script, not a real result.\n3. Observation of the auth host\nLive capture: a Playwright browser navigated to each platform's login flow and the openid.return_to hostname was read from the intercepted request. Login-page notice: the hostname was read from Steam's own \"<host> is not affiliated with Steam or Valve\" text, which Steam renders from openid.realm (rbsnin.com, sc-auth.net, auth.dota.trade). Supplied URL: a Steam loginform URL provided to the authors; this establishes the request parameters, not a completed login. No login was completed on any platform.\n4. Coverage — what was not resolved, and why that matters\nOf the 189 platforms, 110 produced no established route and one was not applicable (189 − 78 − 1). This dossier counts none of them. The breakdown of the 110, from the audit file: 22 bot challenges, 14 timeouts, 12 HTTP errors and 10 navigation errors — the observer could not reach the login flow, though most of these sites open normally in an ordinary browser; 20 showed no Steam login control on the landing page; 16 reached a login flow that could not be resolved to a host; 11 domains did not resolve in DNS; 5 stopped at a consent wall. The register below splits the same 110 differently: the 11 that did not resolve in DNS are listed separately as Removed · NXDOMAIN, and the one not-applicable entry joins the rest. 189 platforms audited, 11 removed on a definitive NXDOMAIN from both resolvers, 178 retained (platform-audit.json, platforms-removed.json). 137 auth domains that the ledger had guessed by naming pattern were deleted from the data on 2026-09-19 — never observed, therefore never evidence. Three of the guesses were contradicted by supplied OpenID URLs: buff.163.com, gamerpay.gg and csgoluck.com authenticate directly, against guesses of buffauthproxy.163.com, gamerpayredirect.io and lucklogin.app. The removals are listed in the published audit file.\nThe 25 is a floor, not a ceiling. Among the 78 platforms that did resolve, 25 used a separate domain and 53 did not. Nothing about the unresolved 110 is assumed from that ratio, and no projection from it appears anywhere in this dossier. Each one is resolvable by a person opening the site and pressing \"Sign in with Steam\": the auth hostname is in the URL of the Steam page that loads.\nThe point of this section: an independent observer needs a browser and a lot of patience to resolve 189 platforms, and got 78. Valve needs a database query. Every platform that uses \"Sign in with Steam\" — resolved and unresolved alike — sends openid.realm to Valve's authentication endpoint on every login. The gap in this table exists because the authors are outside the system. It does not exist for Valve.\nObserved proxy hostnames are in auth-route-audit.json. Domain registration dates from RDAP (Verisign) / IP2WHOIS. Link Filter results in linkfilter-all-results.json.\nAnalogy for clarity\n\nImagine a licensed taxi company is told by regulators that it may no longer operate from its registered Main Street address. The company removes the sign from Main Street. That sign removal is documented. However, the same company opens a Side Street address — registered under a different name — and continues operating from there. The regulators operate the central dispatch system that every taxi from both addresses uses. Every ride request shows \"pick up from Side Street.\" The regulators never revoke the Side Street licence. The removal of the Main Street sign is the only enforcement that occurred. The taxi company never stopped operating.\n\nPart A — Technical record · Section 3.1\nInside Steam, Valve's list is the only list.\n\nA link clicked in the Steam client, the in-game overlay or Big Picture mode does not open in the user's browser. It renders inside Steam's own embedded browser — where the warning layers a browser would apply are not present. The Link Filter is not one safeguard among several. It is the whole of it.\n\nIn a normal browserThree independent layers\nGoogle Safe BrowsingA full-page interstitial for hosts on Google's phishing and malware lists, updated continuously and independent of the site being visited.\nThe antivirus browser extensionMost consumer endpoint products ship a browser add-on that checks the destination against the vendor's own reputation list.\nEndpoint HTTPS inspectionWhere the product performs TLS inspection, page content is scanned before it reaches the user.\nIn the Steam client, overlay and Big PictureOne layer\nGoogle Safe BrowsingNot present. The check requires Google API keys that are not provisioned in embedded Chromium builds; where they are absent, Chromium's own design documentation records that the Safe Browsing handler is simply never added to the request chain.\nThe antivirus browser extensionNot present. Steam's renderer is not the user's browser and loads no extension from the user's browser profile, so no add-on runs against the page.\nEndpoint HTTPS inspectionProduct-dependent. The traffic terminates inside a code-signed Valve process rather than a recognised browser, and a number of endpoint products exempt signed applications from TLS inspection.\nThe Steam Link FilterValve's own blocklist, consulted when a link leaves the Steam ecosystem. This is the sole check that runs — and the table above records what it returns for the auth hosts documented in this section.\nA test any reader can run, and the finding falls if it fails\n\nOpen one of Google's published Safe Browsing test URLs (testsafebrowsing.appspot.com) in Chrome: a full-page red interstitial appears. Open the same URL from a Steam chat message, so that it renders in the Steam client or the overlay: no interstitial appears. The only warning Steam can produce is its own Link Filter page, and only for hosts on Valve's list.\n\nValve's own bug-bounty recordThe one layer has been got around before — on Valve's own record\n\nIf the Link Filter is the only check that runs inside the client, its own failure modes are not a side issue. Two reports on Valve's HackerOne programme, both accepted, both resolved, both since disclosed in full:\n\n#291750archived 2025-11-16 ↗Open Redirect · medium\nLink filter protection bypass\n\nReported 19 November 2017, resolved, disclosed 9 May 2018. The report's own proof of concept: substituting the ideographic full stop 。 (%E3%80%82) for the dot in a hostname — it is possible to bypass the blocking. The interstitial this section is about did not appear.\n\n#1079561archived 2026-09-24 ↗Information Disclosure · high\nBig Picture web browser leaks login cookies and discloses sensitive information (may lead to account takeover)\n\nReported 15 January 2021, resolved, disclosed 21 September 2021. Valve's own severity rating is high, and the title states the consequence. The disclosed record carries the title, rating and dates; the technical write-up is not in the published payload, so nothing further is quoted from it here.\n\nThe authors' reading, not a finding of either report: the two sit on either side of the same gate. One is the warning failing to appear before the destination opens; the other is the session leaving the client once a page is open inside it. The sequence that follows a stolen session — key registered without a prompt, the real trade cancelled, a duplicate sent to a clone — is the pattern set out in Section 5 to Section 8. Both reports are closed; neither is offered as a live vulnerability. What they establish is narrower and enough: the single remaining layer has a documented history of being got around, on Valve's own record.\n\nSource: the HackerOne disclosure record for each report, retrieved 2026-09-22 — number, title, team, weakness, severity, report and disclosure dates and state as published by HackerOne. Retrieval record: hackerone-reports.json. No bounty figure is stated here; none appears in the disclosed record retrieved.\n\nField observation · PhishDestroyDetections that normally end a campaign did not end these\n\nWe watched phishing hosts keep pulling traffic while carrying 20 or more vendor detections. Delivered by web or email, a campaign in that state dies in days — the browser and the antivirus both act on those verdicts. Inside Steam neither does. The verdicts existed the whole time. Nothing in the client ever asked.\n\nWhat this means for a minor with an antivirus installed\n\nHe ignores no warning and disables nothing. A message arrives inside Steam — a free knife, a vote for a friend's team — and the page opens inside Steam. He never opens a browser, so the browser never protects him. His antivirus is running and may already rate that domain malicious; it is never asked. Every warning that could have stopped him already exists. None of it reaches him. He believes he never left Steam, and he did not.\n\nThe giveaway is not the phisher's invention — free Valve items are how the skin and gambling sites advertise, which is exactly why the message reads as ordinary. Complaints: the enforcement archive. Age and children's data: Section 17.\n\nSources: Steam renders web content through the Chromium Embedded Framework in the steamwebhelper process — see DARKNAVY's technical analysis of 27 June 2024 ↗ and Valve's own Steam Client Beta forum ↗ archived 2025-08-04 ↗. No CEF version is relied on: embedded Chromium is not Chrome and ships none of Chrome's Google services. Safe Browsing without API keys: Chromium design document ↗ archived 2026-08-21 ↗, Chromium API keys ↗ archived 2026-08-30 ↗ (“Many of the Google APIs used by Chrome are specific to Google and not intended for use in derived products”), and the same effect in other unkeyed builds — Homebrew cask #193814 ↗. Test URLs: testsafebrowsing.appspot.com ↗.\n\nTwo different clocks\nThe domain’s age.The observation’s date.\n\nA registry creation date establishes when a domain was registered. A dated OpenID record establishes the return host in that record. The former cannot fill the years before the latter.\n\nThe complete register distinguishes a separate registrable domain, a site’s own subdomain and a direct route. Each row links to its source and DNS result.\n\nInspect the domain register →· Download registry dates ↗· Download observation data ↗\n\nPart A — Technical record · Section 4\nAn endpoint closed. Public tracing lost a key.\nContext & source limits\n\nSteam shipped changes that removed public visibility of item Asset IDs and restricted API inventory access. The effect: tracing a specific item by its original Asset ID became impossible from public data. What follows is what was possible before, what stopped being possible after, and what that costs a victim trying to prove where their property went. The date is 2017 according to CSFloat's engineering account; no Valve changelog has been located. The sequence — roughly a year after the July 2016 gambling statement — is the investigative question, not a finding. The item records themselves remain inside Valve's systems; outside investigators lost access to the original-ID chain, while float, seed and paint identifiers allow only partial matching.\n\nThe rule Valve applies: Steam Support does not restore items that left your account, and the burden of showing what happened is yours. The record: in 2017 Valve closed the endpoint that carried original item IDs. Before it, anyone could follow a stolen skin from the victim's account into a marketplace bot. After it, nobody outside Valve can. The proof the victim is asked for is the proof that was switched off — and it still exists, inside Valve.\n\nThe Pre-Blackout Era\n\nHistorically, every virtual item generated on Steam possessed a globally unique, immutable Asset ID. Third-party OSINT databases could index these IDs. If a user had an item hijacked, investigators could trace the lineage of that specific asset as it moved from the hijacker's intermediate account into the storage accounts of a marketplace or gambling site.\n\nBEFORE: an item could be followed from the victim's account through intermediate accounts and into a marketplace or casino storage bot, by anyone, using public data.\nAfter the change\n\nAccording to CSFloat's engineering account, Valve closed the endpoint in 2017 and original item IDs stopped being available to outside parties. No Valve statement of the reason for the change has been located. In the same period, no published action against the commercial bot accounts that moved items at scale has been located either.\n\nWhatever the reason for it, the change severed the public chain of custody. A victim can no longer reproduce the original-ID chain from public data to show that a specific stolen item was liquidated through a specific marketplace or casino. The item records still exist inside Valve's systems; the public, researchers and law enforcement working from public data cannot reach them.\n\nAFTER: tracing a specific item by its original Asset ID is no longer possible from public data. The original-ID chain of custody for an item moved after 2017 exists only inside Valve's infrastructure; no such record has been produced publicly. Float, seed and paint identifiers allow only partial, probabilistic matching.\nIEconItems_730\nGET/IEconItems_730/GetPlayerItems/v1/\nTraceable Payload (Pre-Patch)\n\"id\": \"14892281934\",\n\"original_id\": \"11829910211\",\nStatus: Victim can track item lineage across bot accounts.\nObfuscated Payload (Post-Patch)\nCurrent\n\"id\": \"HIDDEN_BY_PRIVACY_SETTINGS\",\n\"original_id\": \"NULL\",\nStatus: outside parties can no longer trace item lineage by original Asset ID from public data.\nEffect on evidence: after the change, the public data needed to follow a specific item by its original Asset ID from a victim's account into a marketplace or casino bot was no longer available. The internal records still exist at Valve; a victim, researcher or investigator working from public data cannot reproduce the original-ID chain (float, seed and paint identifiers allow only partial matching).\n\nSource: CSFloat engineering account of the 2017 closure of IEconItems_730/GetPlayerItems — blog.csfloat.com/how-floatdb-tracks-items (archived 2026-09-21) · the payloads shown are an illustration of the field shape, not captured responses · no Valve changelog for the closure has been located.\n\nPart A — Technical record · Section 5\nOne session. More access than the user sees.\nContext & source limits\n\nValve's API-key architecture, as it stood before the 2023 changes, departed from baseline industry standards (OWASP ASVS, NIST SP 800-63B) and is the mechanism described in the automated inventory-theft complaints preserved in the evidence archive (Sections 6–8).\n\nThe rule Valve applied: the account holder created the key, accepted the terms, and bears the loss — that is the answer in the archived refusals. The record: until December 2023 a stolen session cookie alone could register that key. No password. No Steam Guard. No notification to the person whose account it was. The user did not create the key, could not see it, and was told he did. Mobile confirmation was added on 2023-12-04 — about seven years after the 2016 statement and roughly six after the scam panels the archive preserves. Those years were not paid by Valve. They were paid by the accounts emptied in the meantime, a share of them children's.\n\nOWASP ASVS 2.8 / NIST SP 800-63BSEVERITY: CRITICAL\n1. Insufficient Step-up Authentication\n\nSteam allowed the generation of highly privileged, long-lived API keys using only a session cookie. No 2FA (Steam Guard) or step-up authentication challenge was required when setting up or modifying a developer API key, so the Steam Guard mobile confirmation — the only second factor Steam offers — did not protect this step. (A hardware second factor was requested in Valve's own tracker in 2016 and the issue is still open: Appendix D, GH-01.)\n\nStatus: unpatched before 2023. Allowed a script holding a stolen cookie to register a key without any user interaction.\nOWASP A01:2021 / Least PrivilegeSEVERITY: CRITICAL\n2. Lack of Principle of Least Privilege\n\nThe Steam Web API lacked any role-based authorisation scopes. A developer API key issued for \"read-only\" inventory status possessed complete \"write\" permissions — including the ability to manipulate existing trades, initiate new ones, register webhooks and decline valid pending exchanges.\n\nStatus: systemic design defect. One key = full read/write control of the account's inventory and trades.\nOWASP A07:2021 / SessionsSEVERITY: HIGH\n3. Broken Session Management\n\nHijacked web sessions originating from server-hosting IP ranges were reported by users to persist. Standard practice is to terminate sessions on geographic anomalies and on password change; user reports collected in the archive describe sessions that remained active after a password change.\n\nStatus: reported behaviour (user complaints in the archive). Sessions could generate API keys without re-authentication.\nDomain-level blocking was technically feasibleENFORCEMENT FEASIBILITY\n4. Domain-Level Blocking of Auth Hosts Was Technically Feasible\n\nValve already operates a domain list (the Link Filter) and already receives every auth hostname in its own OpenID requests. The two mechanisms are not connected in any way visible from outside: as of 2026-09-22, in 26 pairs the main domain was on the filter while the proxy carrying its login was not.\n\nConnecting them is a small engineering task: read the openid.realm hostname from each incoming request, compare it against a list, and refuse or flag the request. The illustration on the right shows the shape of such a routine. Refusing the auth host — rather than only the public landing page — would interrupt the \"Sign in with Steam\" step that these platforms depend on.\n\nNo public evidence shows that Valve runs such a check. The Steam Community Market's combined fee of about 15% applies to sales completed inside the Market; it is not collected on these platforms' external trades.\n\nblock_auth_hosts.pyILLUSTRATION\n// Read the host Steam already receives — no scanning\ndef on_openid_request(request):\nhost = parse_openid_realm(request)\nif host in blocked_domains:\nrefuse(request)\nNote: pseudocode for illustration only. Both halves already exist at Valve — the auth hostname arrives in the request, and the domain list is the Link Filter. No public record explains why they are not connected.\nSection 5.1 — The standards were not unpublished\nValve builds against these rules every day. It did not build to them here.\n\nSteam ships on the App Store and Google Play, sells through the major card processors, and consumes third-party APIs like any other large platform. Each of those relationships carries a published, dated security requirement that Valve must satisfy to keep operating. Set the dates of those requirements against the dates on which Steam's own Web API acquired the same protections. Nothing below is a private standard, an internal memo or a trade secret: every row is a public document with a publication date.\n\nPublished external security requirements, with their dates, set against the date the Steam Web API acquired the equivalent control\nThe published standard, and the date it took effect\tThe Steam Web API on the same question\nScoped authorisationOAuth 2.0 — RFC 6749, October 2012. Section 3.3 defines scope so a client receives only the access it asks for. It has been the default of every major platform API since.\tGranular scopes arrived on 16 January 2026.Before that a single Steam Web API key carried full read and write over the account's trades regardless of why it was issued. Thirteen years and three months after the specification that defines the control.\nA key is not an authorisationGoogle's own Cloud documentation: A standard API key doesn't authenticate a principal, and for APIs that create or manage resources, don't use authorization keys in production.\tThe Steam Web API key was exactly that.A bearer string, issued to an account, sufficient on its own to read the inventory, cancel a pending trade and send a new one. No principal was authenticated at the point of use.\nMulti-factor authentication on privileged accessPCI DSS 3.2, requirement 8.3 — mandatory from 1 February 2018 for all non-console administrative and all remote access to the cardholder data environment. Apple then required two-factor authentication of every Developer Program account holder from 27 February 2019: developers with the Account Holder role in a developer program will need to enable two-factor authentication to sign in.\tA second factor was required to create an API key from 4 December 2023.Until then a stolen session cookie was enough, with no prompt on the account holder's phone and no notification afterwards. Four years and nine months after Apple made Valve itself use a second factor merely to sign in to a developer portal.\nCredential lifecycle and revocationTwitch requires of every third-party application: Your app must validate the OAuth token when it starts and on an hourly basis thereafter, and states that it audits for applications that do not. Its legacy v5 API was retired outright on 28 February 2022 on a published schedule.\tNo published key-lifecycle record.The 2023 change protected the creation endpoint. No Valve statement located with it addresses keys already registered, and no changelog accompanied the change at all. Whether keys created before it were invalidated cannot be established from public data — which is the question a data subject would need answered to know whether a key created on their account years earlier is still live.\nArchitectural Benchmark // Token Architecture\nGitHub Fine-Grained Scopes vs Valve Steam Web API\n\nValve developers manage open-source software on GitHub daily using granular least-privilege tokens. Compare that with the monolithic key issued to 130M Steam players.\n\nGitHub Fine-Grained Token\nUsed by Valve on GitHub\n\nFine-grained token with scoped isolation and mandatory lifecycle enforcement.\n\nRepository Access:Selected Repos only (1 repo)\nIssue Permissions:Read-only [✓]\nCode & Secrets:No access [✕]\nExpiration:30 Days (Mandatory TTL)\nAudit Logging:IP, User-Agent & Timestamp\nSecurity Posture: Least-privilege token limits damage to a single read-only resource.\n!Valve Steam Web API Key\nIssued to 130M Users\n\nSingle 32-character master string carrying all-or-nothing trade and inventory authority.\n\nAccount Access:FULL ACCOUNT (Monolithic)\nTrade Management:Read, Cancel, Decline [!]\nGranular Scopes:NONE (Arrived 2026, 13y late)\nExpiration:NEVER (Valid indefinitely)\nAudit Logging:NONE (Zero IP history for user)\nVulnerability: Stolen key allows silent interception of all outgoing trade offers.\nThe standard applied in one direction\n\nSuppose a vendor Valve depends on — a cloud provider, a payment processor, a CDN — left a credential endpoint without a second factor, and months later Valve's own corporate data left through a key minted at that endpoint. Would Valve accept that the fault lay with whoever clicked the link? The archived refusals preserved in this dossier answer the mirror-image question for the user: the position taken is that the account holder created the key and bears the loss. The same architecture is described as the vendor's failure in one direction and the user's responsibility in the other. Which it is, is not a technical question, and it is not one this investigation can settle — it is what a court or a supervisory authority decides.\n\nIllustration, not evidence — the standard read back the other way\nA payment processor that let a third-party script mint a full-privilege transaction credential from a browser cookie alone, with no prompt to the account holder.\nAn identity provider that closed the hole its tokens were minted through and published nothing about the tokens already minted.\nA bank that answered a disputed transfer by observing that the credential used was registered on the customer's own account, and closed the ticket.\n\nNone of these is offered as a finding about any named company. They are the same design decisions, moved to a setting where the supervisory response is well documented — which is the comparison a regulator is being asked to make.\n\nWhat the record establishes: the controls absent from the Steam Web API were public, dated and, in several cases, conditions Valve had to satisfy to keep shipping its own products. The interval between each standard and the equivalent Steam change is measurable and is set out above. What it does not establish is why. No Valve statement of reasons for any of these intervals has been located, and none is assumed here; that record exists inside Valve and has not been published.\n\nSources, each a public document: OAuth 2.0 — RFC 6749, October 2012 ↗ · Google Cloud — API keys documentation ↗ · PCI DSS 3.2 requirement 8.3 — PCI SSC resource guide ↗ · Apple — Upcoming Two-Factor Authentication Requirement for Account Holders, 20 February 2019 ↗ archived 2025-05-06 ↗ · Twitch — token validation requirement ↗ and the v5 shutdown notice ↗ archived 2025-01-27 ↗. Steam's own dates are those in the update record in this section; the 2023 and 2026 entries are the ones Valve shipped without a changelog. Retrieved 2026-09-22.\n\nValve's own update record — dated, from public sources\nDate\tValve change\tAnnounced?\tWhat it closed\tLag: mechanism public → fix\tSource\n2026-09-01\tAutomated Suspicious Chat Flagging\tYes\tDangerous links / patterns in group chats\t—\tnews ↗\n2026-01-16\tSteamworks Web API granular scopes\tYes\tLeast-privilege scopes for developer keys\t—\tannouncement ↗\n2025-07-15\tCS2 Trade Protection & reversal window\tYes\tNothing. Not a root-cause security fix. Support-side account recovery access remains untouched. Triggering reversal inflicts an automatic 30-day trade lockout (Skinvault ↗), while cash-trading shock caused a $104M (-25%) 24h market cap plunge (CSMarketCap ↗). In 2026, timers became per-item (Skin.land ↗).\t—\tFAQ ↗\n2025-05-14\tAccount Security Announcement\tYes\tStealer / session-hijack guidance\t—\tannouncement ↗\n2024-10-02\tCS2 'The Armory' 7-day hold\tYes\tHold on trade/market for Armory items\t—\tannouncement ↗\n2024-09-18\tNew-device login trade restriction\tYes\t2–7 day trade lock on new devices\t—\tFAQ ↗\n2024-02-14\tProfile name & avatar change hold\tYes\t2–4 h cooldown on trades after rename\t—\tpost ↗\n2023-12-04\tMobile confirmation for API keys\tNo changelog\tSilent cookie-only key registration\t≈6 years after the 2017-era panels\tdev page ↗\n2023-10-24\tSMS MFA for game build publications\tYes\tSteamworks build publishing\t—\tannouncement ↗\n2023-07-12\tCustom biography content warning\tYes\tPhishing links in bios\t—\tforum ↗\n2023-01-25\tProfile {LINK REMOVED} & cooldown\tYes\tLinks in profile text\t—\tFAQ ↗\n2022-10-24\tLogin overhaul & cookie truncation\tNo changelog\tInfinite stolen sessions\t— (IAuthenticationService token migration)\tnews ↗\n2022-10-12\tMobile App 3.0 QR login\tYes\tSession deauthorisation panel\t—\tnews ↗\n2022-05-10\tTrade-cancellation endpoints removed\tNo changelog\tOffer-swap (cancel & re-send)\t≈5 years after the 2017-era panels\tissue #325 ↗\n2020-05-25\tDota 2 7-day trade lock\tYes\tFast item flipping\t—\tblog ↗\n2018-03-29\tCS:GO 7-day trade lock\tYes\tInstant bot laundering\t≈20 months after the July 2016 statement\tblog ↗ archived 2025-02-26 ↗\nSources: the linked Valve posts, help pages and GitHub issues, as dated. Three decisive fixes shipped with no changelog (2022-05, 2022-10, 2023-12) and were detected by users, not announced by Valve — that asymmetry is part of the enforcement record. Lags are computed only where the dossier's own dating (July 2016 statement; 2017-era scam panels) supplies the start point; \"—\" means no such start point is established here.\nPart A — Technical record · Section 6\nInteractive Exploit & Hijack Simulator\nContext & source limits\n\nA reconstruction of the path from the phishing message to the server-side key registration and the trade swap. Before 2023, a Web API key registered on an account could read its inventory, cancel a pending trade offer and create a new one, and no trade-confirmation screen was shown to the account holder for any of those actions. That is the absence of least privilege (OWASP A01:2021). The timings in this simulation are illustrative and are not live measurements of the current platform.\n\nStep through the reconstructed hijack. Each phase shows what the account holder sees and, beside it, the call Steam receives at the same moment. Every one of those calls is correctly authenticated. Nothing in the sequence needs Steam's authentication to fail — it needs the key it issues to carry no scope (OWASP A01:2021).\n\nWhat the player sees. What changes behind it.WALKTHROUGH SIMULATOR\nStep 5 / 5\n\nThe Exploit Completed. Expecting a mobile prompt for their original trade, the victim approves the replacement trade. This is an integrated forensic walkthrough showing how the absence of Least Privilege (OWASP A01:2021) enables automated, sub-second asset hijacking.\n\n01 / THE CHAT LUREA friend asks to voteVictim receives a message with a link.\n02 / THE LOGINA lookalike portalVictim enters sign-in credentials.\n03 / THE ACCESSSilent Web API creationAttacker registers a developer key.\n04 / THE SWITCHLegitimate trade swappedClone bot duplicates target recipient.\n05 / CONFIRMATIONCounterfeit approvedWrong offer approved on mobile.\nThe same step, seen from the networkReconstruction of the pre-2023 pattern · illustrative call shapes\nVictimApproves the mobile prompt that was expected for the original trade.\nAttackerReceives the items at the clone account.\nSteam seesA transfer confirmed by the account holder on a registered device.\nConfirmation genuine — made by the account holder\nRecipient the clone bot, not the intended counterparty\nThe confirmation is authentic. The offer it confirms is not the one the user initiated.\n\nThe record left behind: a trade the user approved. That is the record Steam Support reads when the complaint arrives, and the reason the archived complaints were closed as user error. The complaints are in the enforcement archive.\n\nPart A — Technical record · Section 7\nThe endpoints behind the sequence.\nContext & source limits\n\nThese are the Steam Web API endpoints that the reported hijack scripts used to intercept trades without passing through the browser-side confirmation steps.\n\nFour documented endpoints do the whole job. None of them is a flaw, none needed exploiting — a valid key calls them and Steam answers. The key is the only thing the attacker had to steal.\n\nIEconService / GetTradeOffers / v1POLLING\n\nUsed to monitor the account's trade offers. Scripts poll this endpoint repeatedly with the compromised API key; it returns the details of newly created, pending or modified trade offers. Polling intervals are not measured here.\n\nThreat vector: Discloses pending trade offer IDs and the recipient's profile details.\nIEconService / CancelTradeOffer / v1INTERACTION\n\nUsed to programmatically invalidate the user's legitimate trade offer. Before 2023 no step-up authentication protected the key, so an automated server could cancel an offer as soon as it was detected, without any prompt to the account holder.\n\nThreat vector: Voids the trade before the account holder completes the mobile confirmation.\nISteamUser / GetPlayerSummaries / v2RECON\n\nQueried to retrieve the profile name, avatar image URL and level of the legitimate trade recipient. This lets the script dress a prepared clone account to match. No timing is measured here.\n\nThreat vector: Supplies the data needed to impersonate the intended recipient.\n/dev/ajaxregisterkeyCREATION\n\nSteam's registration endpoint for keys. Historically, any active browser cookie session (`steamLoginSecure`) could register a key without a Steam Guard confirmation on the mobile device, and without any notification to the account holder.\n\nThreat vector: A persistent credential created by a script, unseen by the account holder.\nPart A — Technical record · Section 8 · GDPR Article 7\nA checked box. Whose action?\nContext & source limits\n\nIn declining reimbursement, Steam Support replies preserved in the archive take the position that the account holder created the API key and, by checking the box, accepted the terms.\n\nThe support response attributes the key to the account holder. The question is whether the record establishes who actually created it.\n\nIn the observed API-key hijack pattern, however, the victim never saw or navigated to the API key creation page. The consent field is submitted by a script executing a headless POST with the stolen session cookie.\n\nUnder GDPR Article 7 and Article 4(11), consent must be a freely given, specific, informed and unambiguous indication of the data subject's wishes. The authors' position is that a terms-acceptance field submitted by a hostile script with a stolen cookie, with no page shown to the account holder, cannot meet that definition. Whether it does is for the supervisory authority.\n\nForensic Payload Analysis: Key Registration\nPOST https://steamcommunity.com/dev/ajaxregisterkey\n// Request Payload (Injected via hijacking script)\n{\n\"agreeToTerms\": \"agreed\", <-- machine-injected, no human interaction\n\"domain\": \"localhost\", ← not validated — any value accepted, including localhost\n\"sessionid\": \"8f0d8ef763ab2140bf89de2a\"\n}\nThe question for the supervisory authority: where the account holder never clicked the consent field, whether the terms-acceptance recorded against the account meets Article 7's requirement of a freely given, specific, informed and unambiguous indication of the data subject's wishes, and whether Steam Support may rely on it to decline a claim.\n\nSource: request shape of key registration as reconstructed from the public endpoint and from hijack reports preserved in the evidence archive (searchable build of 2026-09-17) · the session identifier shown is a placeholder, not a captured value.\n\nForensic Autopsy · The Trade Substitution Vector\nHow Valve Finally Neutralized \"Trade Substitution\" — And Why It Took 7 Years of Workarounds\n\nFor nearly a decade, the \"API Key Trade Substitution\" (or API MitM Scam) was the most lucrative account theft model on Steam, siphoning hundreds of millions of dollars in skins from unsuspecting players. Valve did not eradicate the exploit by fixing the vulnerable API architecture; instead, Valve spent seven years layering four platform-wide friction barriers that crippled community trade liquidity while leaving the root cause unaddressed.\n\n1. The Mimicry Death\nAvatar & Name Cooldown (Feb 2024)\n\nThe exploit required sub-second mimicry: the scam bot intercepted an outgoing trade, scraped the recipient's avatar/name via ISteamUser, and cloned the profile in 200ms. On 14 February 2024, Valve quietly implemented a mandatory 2-to-4 hour trade cooldown (Error 34) immediately following any profile name or avatar change. A bot can no longer clone a recipient on the fly without locking itself out of trading.\n\n2. The Economic Death\n7-Day CS2 Trade Reversal (Jul 2025)\n\nValve introduced unilateral Trade Reversals for Counter-Strike items. Any traded skin is tagged \"Trade Protected\" for seven days. If a victim discovers a substitution, they click \"Reverse Trade\" in Steam Support, and the skin is instantly returned to their inventory while freezing the recipient. Because the 7-day trade lock prevents scammers from moving the item to a cashout site, the theft is rendered unprofitable.\n\n3. The Silent Key Death\nMandatory Mobile Push for API (Dec 2023)\n\nHistorically, a stolen session cookie allowed malicious scripts to execute a headless background POST to /dev/ajaxregisterkey without notifying the victim. On 4 December 2023, Valve mandated an explicit push confirmation on the Steam Mobile App to generate a Web API key, eliminating silent background key provisioning.\n\n4. In-App Mobile Warnings\nAccount Age & Name Banners (2022–2024)\n\nValve revamped the mobile confirmation modal to display the trade partner's Steam account tenure (creation date), Steam level, and an explicit amber warning: \"This user has recently changed their profile name\", breaking the visual illusion for attentive victims.\n\nThe Three Flaws in Valve's Patchwork: Why Scammers Simply Shifted Targets\n1. The Game Exclusion Loophole (Dota 2 & TF2)\n\nTrade Reversals were deployed exclusively for Counter-Strike 2. Dota 2 and Team Fortress 2 items remain completely unprotected due to crafting and socketing complexities. High-tier items worth thousands of dollars (Dragonclaw Hooks, Golden Baby Roshans, Unusual TF2 burning flames) carry zero reversal window. Scammers simply redirected automated API interception onto Dota 2 and TF2 traders, where Steam Support strictly enforces its 2016 \"no item restoration\" policy.\n\n2. The \"Zombie Key\" Reservoir (Zero Expiration)\n\nWhile Valve added mobile push 2FA to generate new keys in December 2023, Valve never revoked, expired, or purged existing legacy API keys. Millions of active accounts that generated keys (or had keys silently created by phishing/malware prior to Dec 2023) still carry active credentials with zero expiration (no TTL) and zero inactivity timeout. Threat actors maintain massive historical databases of these persistent keys, continuing to poll IEconService undisturbed.\n\n3. The Victim Penalty: 30-Day Trading Lockdown\n\nEven in CS2, Valve penalizes the scammed player: clicking \"Reverse Trade\" in Steam Support automatically inflicts a mandatory 30-day trade and Community Market ban on the victim's account. Valve punishes the user with a month-long platform exile as a deterrent against \"frivolous\" reversals, discouraging victims from reversing trades on lower-value liquid items.\n\nThe Core Regulatory Scandal: Seven Years of Workarounds vs. One API Scope\n\nWhy did Valve spend seven years inventing trade holds, account cooldowns, and reversible trade locks—disrupting the entire gaming economy and wiping out $104M in market capitalization—instead of implementing the industry-standard fix?\n\nAs proven by Valve's official Steamworks release on 16 January 2026 (Announcement #493839547938902179 ↗), Valve already built Granular Permission Groups (General, Microtransactions, Economy, Sales Data) and IP Whitelisting for corporate Publisher Keys. Valve had the engineering solution in hand for years. A single user-facing checkbox—\"Prevent this Web API key from accessing IEconService (Trade Management)\" or a home IP whitelist—would have eradicated the trade substitution scam in 2018 with zero economic collateral damage. Valve refused to give regular players the protection it engineered for corporate partners.\n\nPart B — Rules and enforcement record · Section 9\nTheir rulebook. The recorded platforms.\nContext & source limits\n\nThis ledger maps explicit clauses from the Steam Subscriber Agreement (SSA) and Steam Online Conduct (SOC) guidelines directly against active, large-scale commercial entities.\n\nThe rule: no commercial use, no gambling, no bots — and Steam Support quotes those clauses when it refuses to return a victim's items. The record: the same clauses, on their face, cover the commercial platforms in this register, which run on Steam identities, Steam bots and Steam transfers. The clause is enforced against the person who lost the skins and not, on any published record, against the businesses moving them.\n\nIn the archived complaints, Steam Support cites the \"No Commercial Use\" and \"No Automation/Bots\" clauses when declining to restore items to victims of API-key fraud. The same clauses apply on their face to the commercial platforms recorded in this dossier, which authenticate through Steam OpenID and move items through automated Steam accounts. No market-wide revenue figure is estimated here (see the enforcement statistics below). What the record shows is the rule applied to individual accounts in the archived cases and no published per-operator enforcement record for the platforms. That asymmetry is what this section documents.\n\nThe central question / selective enforcementRules → Scale → Accountability\nOne rulebook. Unequal enforcement.\n\nThe register shows commercial services using Steam identities, inventories, bots and transfers as operating infrastructure. The SSA prohibits commercial exploitation and automation without permission. The archived complaints show that rule applied to individual accounts, while the public record does not show an equivalent operator-by-operator account for the platforms documented here. Publish the rule, the evidence and the enforcement decision for each one.\n\n189websites in audit scope\n44separate-domain routes in the live register — 27 with a published evidence file, 17 manually collected. The 189-website browser audit alone resolved 25 of them; the register adds the hand-collected routes.\n12 yr 6 mocsgogem.com blocked in the Link Filter; api.csgem.com registered 2014-03-08 and never blocked — one of 26 such pairs as of 2026-09-22\nNo verified totalmarket-wide revenue estimate excluded\nSteam Online Conduct\n\"…you shall not do, or attempt to do, any of the following on Steam: […] Engage in commercial activity. Examples of such prohibited behavior include: posting advertisements; running contests; gambling; buying or selling Steam accounts; selling content, gift cards, or other items; and begging.\"\n\nstore.steampowered.com/online_conduct ↗ archived 2026-09-21 ↗\n\nSSA § 2.G — Commercial use\n\"…[you may not] exploit the Content and Services or any of its parts for any commercial purpose, except as expressly permitted elsewhere in this Agreement…\"\n\nValve's 2016 notices, as reported, invoked the personal, non-commercial licence. No operator has produced a Valve authorisation on the record. store.steampowered.com/subscriber_agreement ↗ archived 2026-09-18 ↗\n\nSteam Web API Terms of Use\n\"You may not use the Steam Web API or Steam Data in any way that violates the Steam Subscriber Agreement.\"\n\nThird-party skin marketplaces operate through automated accounts consuming the Steam API. The rule text leaves no exception for commercial scale. steamcommunity.com/dev/apiterms ↗ archived 2026-09-21 ↗\n\nSSA § 4.C\nAutomation\n\nScripts, bots and non-human interaction are restricted. The ledger records bot trading, account farms and automated routing at commercial scale.\n\nInspect 153records tagged under this clause ↗\nWhat the record holds under this clause153 tagged platforms\nCase Opening15\nSkin Casino13\nCS2 Market9\nSkin Roulette8\ncsgoempire.com→csgoempirelogin4.comCasino\nrollbit.com→rbsnin.comCrypto Casino\n500.casino→fivezerozero.coLicenced Casino\n\nOf these, 153 are also tagged under SSA § 2.G and 2 are also tagged under SSA § 1.C — the same services fall under more than one clause, which is why the examples repeat.\n\n28 of the 153 were observed authenticating through a separate registrable domain. A tag records a dated observation that brings the platform within the clause on its face; it is not an adjudicated violation, and no Valve authorisation has been produced for any of them.\n\nSSA § 2.G\nCommercial use\n\nCommercial exploitation requires express permission. Compare the documented business models, their scale and any disclosed authorisation or enforcement.\n\nInspect 175records tagged under this clause ↗\nWhat the record holds under this clause175 tagged platforms\nCase Opening15\nSkin Casino13\nCS2 Market9\nSkin Roulette8\ncsgoempire.com→csgoempirelogin4.comCasino\nrollbit.com→rbsnin.comCrypto Casino\n500.casino→fivezerozero.coLicenced Casino\n\nOf these, 153 are also tagged under SSA § 4.C and 24 are also tagged under SSA § 1.C — the same services fall under more than one clause, which is why the examples repeat.\n\n28 of the 175 were observed authenticating through a separate registrable domain. A tag records a dated observation that brings the platform within the clause on its face; it is not an adjudicated violation, and no Valve authorisation has been produced for any of them.\n\nSSA § 3.A\nVPN & location disguise\n\nDisguising residence through IP proxying can lead to termination. Separate-domain auth hosts require a separate analysis: establish what is disguised and which rule applies.\n\nInspect the auth-host evidence ↗\nSteam Help / URL policy\nLink obfuscation\n\nSteam prohibits link shorteners and tools that obscure link destinations. A separate auth domain — rbsnin.com in Rollbit's login flow, auth.dota.trade in CS.MONEY's — raises the comparable question of whether the destination shown to Steam's OpenID verifier identifies the operating site.\n\nValve's URL policy ↗\n\nRule references: Steam Subscriber Agreement, revision 10 September 2026 archived 2026-09-18 ↗ · Steam Web API Terms of Use archived 2026-09-21 ↗ · Steam URL policy (link obfuscation). Counts describe this dossier's records and tags; they are not a count of adjudicated violations.\n\nThe trust deficit\nWho reviews the decision when support closes the case?\n\nThe preserved complaints describe permanent sanctions, unanswered challenges and refusals to restore stolen items. Test those accounts against the actual ticket history, available remedies and account-access logs. A generic phishing explanation cannot establish who initiated a reset or created an API key.\n\nRead the captured complaints ↗Request the underlying records →Moderator relationship graph →\nPart B — Rules and enforcement record · Section 10\nAn automation API. A rule against automation.\nContext & source limits\n\nThe question this section puts is how the two are reconciled: which uses of the API are authorised, by whom, and on what published criteria. No count of authorised commercial API users is estimated here, and none is implied by the absence of a published list — the absence is the finding, not a number behind it. The Steam Support messages quoted above are reproduced by the ArchiSteamFarm project in its own FAQ (verified verbatim 2026-09-22); they are not Valve publications, and the accounts they were sent to are not identified.\n\nThe rule (SSA § 4.C): no scripts, no bots, no non-human systems on Steam. The record: Valve ships a headless REST API whose entire purpose is server-to-server automation, and hands the key to any account. Users are banned for automation; the automation interface is Valve's own product. Which commercial uses are authorised has never been published.\n\nThe \"Game Developer\" Fallacy\nSteamworks SDK (Legitimate)\n\nUsed by legitimate game studios to integrate achievements, matchmaking, and leaderboards into their game clients. Requires complex C++ integration and official partner onboarding.\n\nSteam Web API (The Loophole)\n\nA headless JSON/REST architecture designed for external web servers. In the hijack pattern documented here it is used to read inventories and manipulate peer-to-peer trades from remote servers; its legitimate uses are not catalogued in this dossier.\n\nWho the key is forAn ordinary Steam user has no in-client need for a Web API key; the key page lives under a developer URL and its documented purpose is external, server-side access. The archived hijack complaints describe victims who did not know the page existed until a key had been registered on their account.\nThe Automation Contradiction\n\nSSA § 4.C provides: \"You may not use any form of scripts, bots, macros, or other non-human-controlled systems ('Automation') to interact with Content and Services on Steam in any manner.\" Yet the Web API endpoints (like CancelTradeOffer) require no human UI and no captcha and bypass the Steam client entirely. The API is designed for server-to-server automation; the rule prohibits automation by users; the boundary between the two is not published.\n\nA server-side position in the trade flow\n\nA Web API key lets a third-party server act on the account's trades without the Steam client. In the hijack pattern, that server sits between the account holder and the trade server.\n\n→No trade-confirmation screen is shown for the key's actions.\n→Allows background polling (GetTradeOffers).\n→Cancels and re-issues offers without user interaction.\nValve built the interface, prohibited user automation in its rules, and has published no criteria for which commercial uses are authorised.\nPart B — Rules and enforcement record · Section 11\nTen days demanded. Ten years to account for.\nContext & source limits\n\nOn 20 July 2016 Valve's general counsel gave gambling operators a 10-day deadline. Ten years later (as of the dossier snapshot, 2026-09-21) at least one platform named in press reports of that notice, CSGOFast, is still operational with a separate-domain auth host. The wording is reconstructed below from press reports of 21 July 2016; the reconstruction is not a scan. The enforcement record the notice implied has not been published. The open letter to the Commission is Section 2.\n\nRead the July 2016 notice beside the later observations. The outstanding demand is an operator-by-operator enforcement record.\n\nOne week earlier — 13 July 2016, in public\n\nOn 13 July 2016 archived 2026-09-21 ↗, Valve described how gambling sites used Steam: OpenID for account identification and automated accounts for trading. Valve stated that using those mechanisms to run a gambling business violated its API and user agreements. Both the description of the mechanism and the prohibition are in Valve's own dated statement. On 2026-09-21 the separate-domain auth hosts tested returned no Link Filter block, and Valve has published no per-operator enforcement record.\n\nEXHIBIT A / JUL 2016TYPESET RECONSTRUCTION\nVALVE CORPORATION\n\nBellevue, WA\n\nDATE:July 2016 (reported by press 21 July 2016)\nFROM:Karl Quackenbush, General Counsel\nRE:Cease and desist — commercial use of Steam accounts\nNOTE:Reconstruction of reported text; not a scan\n\n\"We are aware that you are operating one of the gambling sites listed below. You are using Steam accounts to conduct this business. Under the Steam Subscriber Agreement, Steam and Steam services are licensed for personal, non-commercial use only.\"\n\n\"You should immediately cease and desist further use of your Steam accounts for any commercial purposes. If you fail to do this within ten (10) days, Valve will pursue all available remedies including without limitation terminating your accounts.\"\n\nDossier reconstruction · consult the source record\nKarl Quackenbush\nGeneral Counsel, Valve Corp.\nIN THE MARGIN / EDITORIAL\nTen days.Then what?\n\nThe deadline was specific. The public follow-through should be, too.\n\nValve’s published 2016 position ↗\nA note to the deadline +\nSATIRE / NOT VALVE CORRESPONDENCE\n\nDear deadline,\n\nYou were given ten days. Somehow, the calendar was the only thing that kept working.\n\nPlease forward any reply to the public record.\n\nTimelineJuly 2016 – September 2026\nDeadline in the notice:\n10 Days\nJuly 2016\nElapsed since the notice:\n3,715 Days\nFixed count from 20 July 2016 to the dossier snapshot of 21 September 2026, not a live figure\nPublished enforcement record:\nNone\nNo per-operator account of terminations or blocks located\n\n◀ Days 0–10 — the deadline, to scaleDay 3715 — the snapshot ▶\n\n20 Jul 2016Ten-day demand issuedDay 0\n17 Feb 2024DSA obligations applyDay 2,768\n25 Feb 2026NY AG complaint announcedDay 3,507\n21 Sep 2026Dossier snapshotDay 3715\n\nTen years later, CSGOFast — named in press reports of the 2016 notices — is operational: csgofast.com returned a Link Filter block on 2026-09-19 and 2026-09-21, while its auth host steam-login.authtofast.com (registered 2026-06-30) did not.\n\nFull dated record of Valve's security changes: Security Timeline → · The Washington record and the enforcement standard: below\n\nWhat the record shows: the 2016 notice set a 10-day deadline; Valve already operated a domain list (the Link Filter) and received the auth hostnames in its own OpenID requests; no per-operator enforcement record has been published. Community reports describe a 2018 action against a marketplace (SkinJar), but those reports are unverified and are not relied on here.\nCSGOFAST / THE SAVED AUTHENTICATION ROUTE\nFollow the declared return host.\n\nThe saved route record links csgofast.com to steam-login.authtofast.com. The separate hostname is carried in the Steam OpenID request. It gives investigators a concrete address to compare with Valve's filtering and enforcement records.\n\nInspect the CSGOFast route and its source ↗ · Compare saved Steam Link Filter results ↗\n\nPUBLIC RECORD / WASHINGTON · 2016 → 2026\nTwo deadlines. One unanswered enforcement standard.\n20 JUL\nValve gives gambling sites 10 days\n\nIts counsel's demand warned that continued commercial use of Steam accounts could lead to termination.\n\n27 SEP\nWashington presses Valve\n\nThe state's Gambling Commission demanded evidence of steps to stop skin transfers for gambling and set a 14 October response deadline.\n\n17 OCT\nValve rejects the charge\n\nValve answered after the deadline, disputed that it facilitated gambling, said it had disabled associated accounts, and said it did not want to switch off trading and OpenID for everyone. At least one platform named in press reports of the July notices (CSGOFast) was operating a decade later. Both facts can hold only if the operator replaced the disabled accounts; the record that would show this has not been published. The WSGC should ask Valve to reconcile the two.\n\n2026\nThe routes observed in September 2026\n\nThe route register records 44 platforms authenticating through separate-domain auth hosts, including CSGOFast, using the OpenID and trading mechanisms Valve described in 2016. The enforcement record that would show which operators were cut off has not been produced.\n\nTHE COMMISSION'S OWN BRIEFING · 30 JANUARY 2018\nEighteen months after Valve replied, the regulator still called it an intent.\n\nBriefing its own legislature at the HB 2881 public hearing, the Commission described the July 2016 statement in its own words: Valve \"announced its intent to crack down on the use of its platform to facilitate skins gambling.\" The same page records what that announcement did to the industry forecast — \"as a result,\" the projected 2020 skin-gambling market was revised from $19.7 billion to $670 million, a cut of about 97 per cent, on the strength of the announcement alone. The forecast moved. The per-operator enforcement record that would justify it has still not been published.\n\nThe market figures are Narus Advisors / Eilers & Krejcik Gaming estimates reproduced in the Commission's briefing, not Commission findings; the same document puts 2016 skin wagering at about $5 billion, roughly $3 billion of it on casino-style sites. Retrieved 2026-09-22, SHA-256 c507c9025f93da0aadaf395c4d8882f25973211c318ee8e9b6f18a5b3755e050.\n\nValve's public 2016 position and today's observable infrastructure can be put side by side. The question is whether enforcement reached the accounts and routes used by prohibited operators. A ten-day notice is not evidence that the notice was carried out across the operators it named. The 2018 OPSkins action is the one documented intervention against a named operator; set against 189 platforms checked and no published per-operator record, one documented action does not show a pattern of enforcement.\n\nWashington Gambling Commission's 2016 notice ↗ archived 2026-05-20 ↗ · Valve's 17 October 2016 response (document copy) ↗ · WSGC briefing to the legislature, 30 January 2018 (local copy, 4 pp.) ↗ · the same file on wsgc.wa.gov ↗ · retrieval record & hash ↗ · Valve's 2018 OPSkins action ↗ archived 2026-03-07 ↗ · Current route audit ↗\n\nForensic Longitudinal Audit · 2016 Cease & Desist Targets\nThe 10-Day Notice Decade: Forensic Survival Audit of the 23 Named Sites\n\nOn 19–20 July 2016, Valve General Counsel Karl Quackenbush issued formal cease-and-desist notices to 23 skin gambling platforms, ordering them to cease commercial use of Steam accounts within 10 days under threat of account termination and legal action. Over 3,700 days later, an empirical audit reveals the true pattern of enforcement: multiple operators never ceased operations, others ran for up to six years after the deadline, and the multi-billion-dollar ecosystem continued to leverage Valve's OpenID architecture.\n\n5+ LIVE\nDefiantly operational in 2026 (CSGOBig, CSGO500, CSGOFast, etc.)\n6 YEARS\nLongest post-notice run before closure (CSGOatse active through 2022)\n$5.01B\n2016 skin wagering volume (Narus / Eilers & Krejcik)\n200+\nActive skin gambling sites operating at market peak\nPlatform / Domain\tJuly 2016 Notice\tEnforcement Outcome & Survival Status\tRecorded Verification / Primary Links\nCSGOBig\ncsgobig.com\t10-Day Notice (Jul 2016)\tSTILL LIVE IN 2026\nTemporarily paused, relaunched; authenticates via letmeinbig.com & csgobiglogin.com\tX: @csgobig ↗ · FB: csgobigofficial ↗\nCSGO500\ncsgo500.com / 500.casino\t10-Day Notice (Jul 2016)\tSTILL LIVE IN 2026\nRebranded into 500 Casino (Curaçao license #8048/JAZ2014-037), multi-million monthly turnover\tLive Platform (500.casino) ↗\nCSGOFast\ncsgofast.com\t10-Day Notice (Jul 2016)\tSTILL LIVE IN 2026\nActively operating roulette, crash, and jackpot via steam-login.authtofast.com\tDossier Auth Audit ↗\nCSGOLounge / Dota2Lounge\ncsgolounge.com / dota2lounge.com\t10-Day Notice (Jul 2016)\tSTILL LIVE IN 2026\nPivoted to esports coin wagering and crypto betting; maintained continuous operation\tLive Platform ↗\nCSGOCasino\ncsgocasino.net / csgocasino.gg\t10-Day Notice (Jul 2016)\tLIVE VIA SUCCESSOR (2026)\nDomain redirected; active successor portal operates under csgocasino.gg\tSuccessor Domain ↗\nCSGOatse\ncsgoatse.com\t10-Day Notice (Jul 2016)\tSURVIVED 6 YEARS (ACTIVE TO 2022)\nContinued full gambling operations for six years following Valve's 10-day ultimatum\tX: @CSGOatsecom (Active to 2022) ↗\nCSGOSweep\ncsgosweep.com\t10-Day Notice (Jul 2016)\tSURVIVED TO DEC 2017\nOperated publicly for 17 months after deadline\tX: CSGOSweep Status Dec 2017 ↗\nCSGOWild\ncsgowild.com\t10-Day Notice (Jul 2016)\tSURVIVED TO DEC 2017\nPromoted by major influencers; ran for 1.5 years post-C&D before crypto migration\tX: @Wild (Active Dec 2017) ↗\nCSGOPot\ncsgopot.com\t10-Day Notice (Jul 2016)\tSURVIVED TO SEPT 2017\nOperated high-stakes jackpot betting 14 months past notice\tX: @csgopot (Active Sep 2017) ↗\nCSGODiamonds\ncsgodiamonds.com\t10-Day Notice (Jul 2016)\tSURVIVED TO MID 2017\nRan through 2017 despite admitted outcome tampering for sponsored streamers\tX: @csgodiamondscom (2017) ↗\nCSGOLotto\ncsgolotto.com\t10-Day Notice (Jul 2016)\tCLOSED JULY 2016\nShut down under public scandal; target of federal FTC consent order\tFTC Consent Order (Docket C-4632) ↗\nCSGODouble\ncsgodouble.com\t10-Day Notice (Jul 2016)\tCLOSED JULY 2016\nShut down voluntarily immediately after C&D publication\tX: @CSGODouble (Closed Jul 2016) ↗\nCSGOMassive\ncsgomassive.com\t10-Day Notice (Jul 2016)\tCLOSED 2016\nCeased public operations in late 2016\tX: @csgo_massive ↗\nCSGOStrong\ncsgostrong.com\t10-Day Notice (Jul 2016)\tCLOSED 2016\nCeased public operations in 2016\tFB: csgostrongfree ↗\nSkins2\nskins2.com\t10-Day Notice (Jul 2016)\tCLOSED 2016\nCeased public operations in 2016\tFB: CSNCOM ↗\nThe Surviving Titans · 2024–2026 Financial & Traffic Blueprint\nFrom 10-Day Warnings to Offshore Conglomerates: The Multi-Billion-Dollar Turnover\n\nRather than eliminating skin gambling, Valve's 2016 notices catalyzed an industrial evolution. The surviving operators restructured as offshore corporate entities (Curaçao, Belize, Cyprus), pioneered Peer-to-Peer (P2P) trading to bypass bot bans, and now process over 10 million monthly web visits and billions of dollars in annual wagering handle while continuing to authenticate through Steam:\n\nPlatform\tMonthly Traffic (Visits)\tEstimated Turnover / Volume\tCorporate Entity & Jurisdiction\tKey Regulatory Actions & Model\nCSGOEmpire\ncsgoempire.com\t2.3M — 9.0M / mo\nAvg 6+ min duration; 80% direct\t$1.5B — $2.5B Annual Handle\n>1,000,000 P2P skin trades/mo; $6.4M active liquid order floor\tMoonrail Limited B.V. (Curaçao #148182)\nPayments: JHOLT LTD (Cyprus); Founder: \"Monarch\" (Ossi Ketola)\tPioneered 0% fee P2P item trading; licensed Curaçao OGL/2024/1183/0869\nCSGORoll\ncsgoroll.com\t2.74M — 3.5M / mo\nAvg 9m 23s duration; 16% bounce rate\t$1.0B — $2.0B Annual Handle\nEst. $100M–$200M annual corporate revenue from house edge\tFeral Holdings Limited\nHeadquartered in Belize City, Belize (Reg #171519)\tBanned by Australian ACMA (May 2023); sponsored tier-1 team G2 Esports with underage players\n500 Casino (CSGO500)\n500.casino / csgo500.com\t220K — 425K / mo\n~105k unique monthly visitors\t$100k / week ($5.2M/yr) in Royales\nHigh-roller wagering requirement: $400 wager per $1 rakeback\tPerfect Storm B.V. (Curaçao #150536)\nCuraçao Gaming Control Board license OGL/2024/1354/0882\tBanned by Swedish Spelinspektionen (Nov 2023) for unlicensed targeting of Swedish players\nCSGOBig\ncsgobig.com\t~169,600 / mo\nAvg duration 19m 12s; US primary\tMulti-Million Annual Volume\nMystery boxes, roulette, and case battles\tOperates via auxiliary proxy routing\nletmeinbig.com (reg 2023) & csgobiglogin.com\tTarget of July 2016 C&D; relaunched with proxy auth architecture\nCSGOFast\ncsgofast.com\t~150K — 250K / mo\nGlobal multi-language audience\tMulti-Million Annual Volume\nHigh-velocity roulette and crash games\tOffshore operational entities\nRoutes Steam auth via steam-login.authtofast.com\tTarget of July 2016 C&D; never discontinued operations; active in 2026\nCSGOPolygon\ncsgopolygon.com / plg.bet\t~300K — 500K / mo\nCIS and Eastern European dominance\tMulti-Million Annual Volume\nCrypto & skin roulette, match betting\tSecond-wave target (Oct 2016)\nPivoted to cryptocurrency with mirror domain plg.bet\tSurvived a full decade; continues skin liquidation via third-party APIs\nThe Second Wave: Why Valve's C&D Targeted 43+ Sites in Total\n\nOn 17 October 2016, Valve's legal counsel formally disclosed to the Washington State Gambling Commission that following the initial 23 notices on July 19, Valve had sent cease-and-desist letters to more than 20 additional skin gambling sites (bringing the official total above 43). This second wave was necessitated because the initial list inexplicably omitted the largest, most notorious gambling hubs in the world:\n\nCSGOJackpot.com: The historic originator of skin jackpots, which handled hundreds of millions in volume before shuttering under threat of federal indictment.\nCSGOShuffle.com: The site at the heart of the July 2016 streaming scandal, where Twitch streamer PhantomL0rd secretly owned 33% of the company and was exposed rigging odds with house funds.\nThe Macro Ecosystem (200+ Operators): According to industry research by Narus Advisors and Eilers & Krejcik Gaming, over 200 distinct skin gambling sites operated in 2016, generating $5.01 Billion in wagering volume from 3.03 million active players. Valve's 43 letters addressed less than 20% of the active market.\nOfficial Government & Regulatory Investigations on Steam Skin Gambling\n\nThe skin gambling phenomenon is documented across multiple formal statutory inquiries, enforcement actions, and government position papers:\n\n1. Washington State Gambling Commission (WSGC) (2016–2018)\n\nIssued formal Cease & Desist demand on 5 Oct 2016; published Legislative Briefing on 30 Jan 2018 documenting that skins are cash equivalents and reporting the $5.0B skin wagering volume.\n\nWSGC Legislative Report PDF (Local Copy) ↗\n2. U.S. Federal Trade Commission (FTC) (Sept 2017, Docket C-4632)\n\nFirst federal regulatory enforcement action involving skin gambling against CSGOLotto owners Trevor Martin and Thomas Cassell for deceptive practices and undisclosed platform control.\n\nFTC Decision & Consent Order ↗\n3. UK Gambling Commission (UKGC) Position Paper & Youth Audits\n\nThe Commission treats in-game items convertible to cash as money’s worth. Its 2018 survey found that 3% of 11–16-year-olds said they had ever bet with in-game items (skins).\n\nUKGC 2018 youth survey ↗\nUKGC position on virtual currencies ↗\n4. Australian Senate Environment & Communications Inquiry (2018)\n\nFederal Parliamentary report on \"Gaming micro-transactions for chance-based items\", evaluating Valve's loot box mechanics, secondary market cashouts, and regulatory circumvention.\n\nParliament of Australia Inquiry ↗\nThe outstanding demand\n\nPublish the enforcement record: which gambling accounts and bots were disabled, which return hosts were restricted, and which commercial services received permission. A public prohibition and a homepage warning do not establish that the underlying operation was stopped.\n\nPart B — Rules and enforcement record · Section 12\nThe hostname is already in the request.\nContext & source limits\n\nValve already maintains a domain list (the Link Filter) and already receives the auth hostname in every OpenID request. The pseudocode below shows the logical shape of connecting the two. No public evidence shows that Valve does so.\n\nValve already runs a domain blocklist. Valve already receives the login host in every OpenID request. Nothing needs building — the two have to be joined. That is a hostname lookup against a list Valve maintains itself. The pseudocode below is an illustration, not Valve's implementation.\n\nforensic_autoban.py\n# ILLUSTRATIVE PSEUDOCODE — Valve.block_domain() and flag_session_as_mitm() are not real API calls. This demonstrates the logical structure of a mitigation Valve could implement against proxy auth domains, not actual Valve internals.\n# Illustration: the logical shape of a check on the incoming OpenID request\ndef audit_openid_request(request):\nblocked_origins = database.get_blacklisted_platforms()\nproxy_domain = request.params.get('openid.realm')\ntarget_redirect = request.params.get('openid.return_to')\n\n# Logic: If the proxy routes back to a blocked site, ban the proxy.\nfor site in blocked_origins:\nif site in target_redirect:\nValve.block_domain(proxy_domain)\nValve.flag_session_as_mitm(request.session)\n# Result: the login request for that host is refused\n\nObservation:\nWhere a main domain is already on the Link Filter (e.g. howl.gg, blocked 2026-09-18/19/21) and its auth host (howl.uno) appears in the OpenID request from that site's login button, the association is observable to Valve from its own request data. The check is automatable; whether it is run is not.\nDocumented and reported precedents\n\nValve has intervened against a third-party operator at least once on the record: in 2018 it revoked OPSkins' access over the ExpressTrade system (Valve's announcement ↗ archived 2026-03-07 ↗). Community reports from 2018 also describe a marketplace (SkinJar) losing access; those reports are unverified and the mechanism is inferred from the outcome, not from a disclosed process.\n\nWhat the precedent establishes:\n\nValve can cut off a third-party operator's access when it decides to. CSGOFast, named in press reports of the July 2016 notices, was operating on 2026-09-21 with an auth host registered 2026-06-30 that returned no Link Filter block. Why one operator was cut off and others were not is not explained by any published criteria.\n\nWhat a registration date does and does not show\n\nThe registration date of an auth host is a lower bound on when the host could first have appeared in an OpenID request; it does not establish continuous use. sc-auth.net, for example, was registered 2019-04-02 (RDAP) and was observed in Skin.Club's Steam login flow in September 2026; what happened between those two dates is not in the public record.\n\nComparative Audit: API Compliance Standards\nEnforcement Dimension\tGitHub API Rules\tSteam Web API (Valve)\n1. Compliance Neutrality\tPublished, uniform rules. Documented rate limits (e.g. 5,000 calls/hr for authenticated users, 15,000/hr for GitHub Enterprise Cloud organisations) and published acceptable-use policies apply to every account.\tNo published criteria. Individual accounts are terminated under the automation and commercial-use clauses (archived complaints), while no per-operator enforcement record for commercial platforms has been published.\n2. OpenID / Auth Proxy Abuse\tGitHub's published policies allow OAuth apps and tokens to be suspended or revoked for abuse, and its documentation describes automatic revocation of exposed tokens (authors' summary of GitHub documentation).\tSeparate-domain auth hosts observed in Steam OpenID flows (e.g. rbsnin.com, howl.uno, sc-auth.net) returned no Link Filter block on 2026-09-21 while their main domains did.\n3. Monetization of Abuse\tGitHub takes no transaction fee on items moved by third-party automation; its revenue model is subscriptions and marketplace listings.\tValve sells the case keys that produce the items, and the Community Market charges a combined fee of about 15% on sales completed inside the Market. No figure for revenue attributable to third-party platforms is estimated here.\n4. Evasion Loop Lifespans\tSuspended OAuth client IDs stop working platform-wide at suspension; the documentation does not publish a time-to-action figure and none is assumed here.\tSeparate-domain auth hosts with registration dates from 2011 to September 2026 returned no Link Filter block in the checks of 2026-09-19 and 2026-09-21. Registration date is a lower bound on possible use, not proof of continuous use.\nSources: GitHub column — GitHub's published API rate-limit and platform-policy documentation (authors' summary, not quoted) · Steam column — Link Filter checks of 2026-09-19 and 2026-09-21 (linkfilter-recheck-2026-09-21.json), RDAP registry (domain-registration.json) and the archived support complaints (evidence archive).\nPart B — Rules and enforcement record · Section 13\nThe off-Steam price gap\n\nThe item sits in a Steam inventory; the sale happens elsewhere. A Factory New AWP Dragon Lore had 62 live offers on CSFloat; the cheapest asked $10,623.95. Steam's own market cannot display an asking price above approximately $1,800. To sell for the observed higher price, an owner needs an off-Steam buyer or marketplace. The item and its transfer still depend on Steam.\n\nContext & source limits\n\nThree different counts appear in this section and they are not interchangeable. 245 is the number of CS2 item-name categories whose cheapest active offer exceeded $1,800 on CSFloat alone, 20 September 2026. 241 is that same set minus the four categories pinned at CSFloat's $100,000 ceiling, which is the panel the $13.63M floor is calculated on. 248 is a different snapshot: categories priced above the cap by two or more of five marketplaces on 23 September 2026. The marketplaces overlap, so counts from different venues must never be added. Every figure here is an asking price, not a completed sale, and none of it is revenue, turnover or profit — for Valve or for anyone else. PriceEmpire's listed values are rounded estimates published by that site, and its Steam card covers items from other Steam games, so the scopes across the comparison are not identical.\n\nOne item. Two price systems.FOLLOW THE RECORD\nStep 3 / 3\n\nAt that ask, the seller needs an off-Steam venue or buyer. The item still depends on Steam's inventory and transfer system.\n\nSTEAMAbout $1,800Published Community Market listing cap\nSAVED CATALOGUE$10,623.95Factory New AWP Dragon Lore floor ask\nTHE DEPENDENCYStill a Steam itemThe inventory and transfer remain on Steam\n01 / ITEMValve game inventoryCS2 or Dota 2 item held in Steam\n02 / CEILINGAbout $1,800 on SteamMaximum price for one Market listing\n03 / OUTSIDE ASK$10,623.95 for Dragon LoreCheapest CSFloat offer in the dated snapshot\n04 / DELIVERYSteam remains in the chainOwnership and item transfer rely on its system\nMARKET ARCHITECTURE · DATED SNAPSHOT, 20 SEPTEMBER 2026\nThe price gap is measurable.\n\nWe counted item-name categories whose cheapest active offer was strictly above $1,800. CSFloat and Skinport are separate snapshots with overlapping CS2 inventories; their counts cannot be added. The outside offers show where higher asking prices are posted, while Steam still controls item ownership and transfer.\n\n245CS2 CATEGORIES · CSFLOAT\n166CS2 CATEGORIES · SKINPORT\n3DOTA 2 CATEGORIES · SKINPORT\n$10,623.95DRAGON LORE FLOOR ASK\n\nDragon Lore: 62 active CSFloat offers in the Factory New category; the displayed floor is an ask, not a confirmed sale. Steam permits listing the item for less, but cannot post the observed higher ask. Valve’s 2016 statement confirms its awareness of gambling operators using OpenID and Steam trade infrastructure. Whether a particular third-party marketplace breaches Valve’s rules must be established separately.\n\nInspect the full register →CSFloat JSON ↗Skinport JSON ↗Valve’s 2016 statement ↗\nDIRECT CSFLOAT API / DATED SNAPSHOT$13.63M\n\nMinimum aggregate asking value in 241 item categories and 3,395 active offers. Calculated as each category's cheapest ask × its offer count. Four categories pinned at CSFloat's $100,000 ceiling are excluded from this conservative panel.\n\nWhat the dollar figure shows\n\nThese offers represent at least $13,631,888.25 in posted asking prices for this limited CSFloat subset. Including the four ceiling-priced categories produces $14,231,888.25. This is a floor on active asks, not completed sales, cash turnover, profit or the entire CS2 market.\n\nRecalculate from the 245-row CSFloat snapshot ↗\nPRICEEMPIRE / LISTED VALUESteam: #15 of 39\nMany venues list more dollar value than Steam.\nUUSkins\n$133.8M\nYouPin898\n$127.5M\nBuff.163\n$104M\nMoon.Market\n$100.3M\nWhite.Market\n$89.6M\nBuff.Market\n$86.7M\nSteam\n$31M\n\nThe six largest displayed values and Steam. PriceEmpire rounds these figures; Steam shows $31M. Fourteen listed venues rank ahead of it by the displayed dollar values.\n\nPRICEEMPIRE / OFFER COUNTSteam: #1 of 39\nSteam still leads in number of offers.\nSteam\n32.2M\nYouPin898\n5.9M\nC5Game\n4.6M\nHaloSkins\n4.4M\nSkinport\n3.8M\n\nSteam shows 32.2M offers. Number of offers and total asking value answer different questions; many low-priced listings can dominate the count.\n\nSource: PriceEmpire's public comparison ↗ archived 2026-09-21 ↗, captured 2026-09-20 19:03 UTC; dated 39-row extraction ↗. Its figures are rounded estimates, and inventory can overlap across sites. Steam's card also describes items from other Steam games, so the scopes are not identical. Listed value measures asking prices, not sales or revenue.\n42\nANOTHER SOURCE / STEAMANALYST\nThe commercial ecosystem is in plain sight.\n\nSteamAnalyst's marketplace directory archived 2026-07-19 ↗ lists 42 third-party CS2 marketplaces alongside Steam, with recent price data for 32 of the 43 entries. PriceEmpire lists 39 marketplaces under its own inclusion criteria. Named businesses, public offers, visible prices: this economy is open to inspection.\n\nTHE CEILING IS THE MECHANISM: THE SALE LEAVES STEAM, THE ITEM DOES NOT.\n\nAcross five marketplaces captured in one licensed snapshot, 248 CS2 item categories are independently priced above Steam's approximately $1,800 listing ceiling by two or more of them — and every single one is absent from Steam. The same snapshot banded the whole catalogue by price: Valve's market carries 95.3% of the item categories below its cap and 1.9% of those above it. The collapse does not track falling demand; it lands exactly on the published rule. Selling at those prices requires an outside buyer or marketplace, while Steam still controls the inventory and the transfer — the business leaves Valve's checkout and the delivery stays on Valve's infrastructure.\n\nSteam Market FAQ ↗archived 2026-09-21 ↗Steam Subscriber Agreement ↗archived 2026-09-21 ↗Five-marketplace atlas dataset ↗Provenance manifest ↗Earlier CSFloat snapshot ↗Skinport snapshot ↗PriceEmpire ↗archived 2026-09-21 ↗SteamAnalyst ↗archived 2026-07-19 ↗Price-gap register ↗Price-ladder atlas ↗\n\nPart C — Legal frameworks\nPart C — Legal frameworks · Section 14 · Personnel access\nWho can reset the safeguards?\nContext & source limits\n\nAccount security also depends on the people who can recover an account, inspect private records or reset its safeguards. The investigation must follow those privileged actions as closely as it follows API abuse.\n\nAccount recovery hands a support agent the power to move an account away from its owner. Valve has confirmed in writing, twice — February 2023 and November 2025 — that this power was used to hand accounts to the wrong people. Thirty-three months apart, through the same channel. Below: what that access is worth, six sourced cases, and the log Valve holds for every one of them and has produced to nobody.\n\nPreserved testimony / 9 May 2025\nA recovery ticket that disabled the account's security, and a reported $10,000 loss\n\nA user in the collected support archive reports that Steam Support reset the password and disabled account protection after another person submitted a recovery ticket. The author says the account had been inactive for years, held items since 2016–2017 and had Steam Guard, a linked phone and stored recovery codes.\n\n\"Steam Support still gave someone else access to my account.\"\n\nFirst-person allegation, preserved in steam_support_tickets_MEGA.json, record 110. Read the complete captured post ↗\n\nThis is not one user's bad luck. The same door — a help request that moves an account to whoever supplies the older data — is the documented way in for every case in the ledger below, and Valve has twice put that in writing.\n\nThe owner cannot win that argument. Recovery asks for the first CD key, the first email, the first card, the first phone number. Those facts are in Valve's database, and support-side access reads them — reported as reaching back fifteen years. A person who has a copy of your file will always produce more of your history than you can. Targets were picked to fit: dormant for years, high-value, and often bought second-hand, so the holder never knew the original key. Afterwards the accounts were deleted outright, breaking the item-history trail the community uses to trace a skin — a deletion an ordinary user cannot perform without the standard waiting period.\n\nLeast privilege / OWASP A01\n\nRecovery privileges should be limited to the task, independently reviewed and logged. Audit who could reset credentials, remove Steam Guard, read billing records or export account data. OWASP access-control guidance ↗ archived 2026-09-20 ↗\n\nBroad support accessAccess-scope risk\nBeyond the inventory.\n\nIf broad support access is abused, private telemetry can become a tool for profiling, targeted phishing and surveillance. Potential victims include ordinary users, military personnel, public figures and their families. This is a threat model; the exact permissions require access-control records.\n\n01 IP history & location\nIP logs can expose network history and approximate location. They do not, by themselves, establish precise physical movements.\n02 Device fingerprinting\nDevice identifiers, where collected and accessible, can connect sessions and accounts.\n03 Activity telemetry\nLogin timestamps and session records can reveal routines, including activity invisible on a public profile.\n04 Communications & contacts\nAccess to retained messages or contact information would increase the scope for profiling and social engineering.\n05 Identity unmasking\nOriginal email, phone and payment records can connect a pseudonymous account to a person.\n06 Data resale & accountability\nExported target lists could support targeted scams. Establish the actor, access location, recipients and transfers; location alone establishes neither access nor legal immunity.\n\nValve describes IP logging, device information, payment records and third-party support providers in its Privacy Policy §§ 3, 5.2 archived 2026-09-21 ↗. The policy authorises third-party support access — the audit trail that would show which contractor accessed which category, when, and under what authorisation has not been disclosed.\n\nSection 14.1 · the register · June 2022 → November 2025 · every figure sourced\nValve admitted the door twice, thirty-three months apart. It never closed.\n\nSix reported cases in which accounts were taken through Steam's own help-request channel, or through the credentials that channel protects. Each amount is the figure the cited source published, and each source is named. Two of the six were made whole. The difference between them and the rest was not what happened — it was who was watching.\n\nValve, in writing — February 2023\"The items in question were removed from your account because they were received from an account that was compromised through a support help request, for which the CS:GO team takes responsibility. We have reversed the trades and removed them from any account which received them.\"Steam Support reply to a recipient of HFB's items, reproduced by Dexerto, 21 February 2023 ↗ archived 2025-08-18 ↗\nValve, in writing again — November 2025 · 33 months later\"A support technician that handled the help request failed to follow our process which resulted in your account restored to someone else. I apologize for this error.\"Steam Support reply to Hawkeye337, quoted in Dexerto, 14 November 2025 ↗\n21 Jun 2022\nHFB — the largest inventory in the game$2,000,000+ · raised to $3,000,000+ in the February 2023 follow-up\n\nSeven Souvenir AWP Dragon Lores and the #1 Blue Gem Karambit, that knife alone valued at about $1.26 million. The account had been dormant three years with the mobile authenticator still active; the email and password were changed anyway, through the support recovery route.\n\nThe money left before the items did. A reported $200,000+ of sale proceeds was already withdrawn through market.csgo.com — a marketplace that settles in cash and crypto. Reversing a trade returns a skin. It does not return the cash somebody already banked.\n\nAnd the fix broke. One buyer moved his Souvenir Dragon Lore into an in-game Storage Unit. Valve's rollback script could not see inside its own container, so it issued the owner a fresh copy and left the hidden one standing — Valve duplicated a $130,000 item while trying to undo a theft. It was caught by matching item IDs and community reporting, and deleted a month later, in July 2022. The buyer was refunded by BUFF, not by Valve. Emergency remediation this brittle is not a control; it is what a platform does when it has no control.\n\nDexerto, 21 Jun 2022 ↗ archived 2022-07-02 ↗ · Kaspersky ↗ · cash-out figure per Esportfire, 22 Jun 2022 ↗ archived 2026-05-15 ↗, attributed there to multiple Twitter sources · duplication and deletion per Esportsbetting, 14 Jul 2022 ↗\n\nRestoredTrades reversed. Items pulled back out of the inventories of people who had paid full price for them.\n14 Aug 2022\nCS.Money — the platform's own bots$6,300,000 · 19,000+ skins · first estimate $1.6M\n\nAttackers took the mobile-authenticator files of the marketplace's trading bots and emptied them, then sent part of the haul to well-known traders to blur the trail. Community researchers mapped 55 attacker accounts within hours and published them.\n\nValve reversed nothing. The reason given was that a third-party site sits outside Steam — the same Steam whose inventory, trade API and account system the theft ran on end to end.\n\nEsportfire, 14 Aug 2022 ↗ archived 2025-11-15 ↗\n\nRefusedNo reversal. Loss stayed with the platform and its users.\nReported\n21 Feb 2023\nQkss — same door, same actor$1,000,000+\n\nReported as taken the same way HFB was, by the same actor, through the same support help request. HFB was made whole eight months earlier. Qkss was not.\n\nOne route. Two answers. Nothing in the published record distinguishes the two cases except the size of the audience.\n\nDexerto, 21 Feb 2023 ↗ archived 2025-08-18 ↗\n\nRefusedNot restored.\nReported\nFeb 2023\nThe insider trade itself — a year of it≈ $320,000 · proceeds over roughly one year, not an inventory valuation\n\nSupport-side access reached account history up to 15 years old — the first CD key, the first email, the first card. That is exactly the evidence the recovery process asks for, which is why the person holding the database always wins the argument against the person holding the account.\n\nBlogger Mzkshow exposed how insider operator \"Steam Help\" and collaborator \"Alexander\" targeted dormant accounts holding over $100k in skins. One stolen M4A4 Howl carrying iBUYPOWER and Titan Katowice 2014 holos sold for $35,000 and ended up with NAVI's Valerii \"b1t\" Vakhovskyi, who had no way of knowing. After Valve intervened, the contractor dismissed its entire Steam support desk.\n\nVKPlay ↗ · Lis-Skins ↗ · Escorenews (RU) ↗ · Dexerto (EN) ↗\n\nNo registerValve has never published how many accounts this touched, or told the people it touched.\nReported\n2 Dec 2024\n\"Matvey\" — after the sackings$13,000\n\nRecovery was granted to someone who supplied account data the owner himself could not match. Two years after the contractor cleared out its Steam support desk, the same route produced the same result.\n\nPreserved post, 2 Dec 2024 ↗ archived 2025-08-05 ↗ · source rows & hashes ↓\n\nRefusedNot restored.\n13 Nov 2025\nHawkeye337 (Mark Spurlock) — and the second admission≈ $300,000–$500,000 · full Katowice 2014 holo collection\n\nThe attacker demanded 1 bitcoin and began scraping the collection onto Negevs to destroy it. Steam Support's written reply is the second admission above: a technician handled the help request, did not follow the process, and gave the account to someone else.\n\nWhat produced the fix was the feed. Hours after the posts tagging Valve went up on X, the account was taken back and every sticker restored. Qkss did not have that audience.\n\nSkin.club ↗ · Dexerto ↗ · Esportfire ↗ archived 2025-12-17 ↗\n\nRestoredReversed within hours of the story trending.\nWhat the ledger says that no single case does.\n\nThe route never closed. The first admission is dated February 2023 and the second November 2025 — thirty-three months apart, with the contractor's mass dismissal, a documented recurrence and a $6.3 million platform breach in between. Counting from the first theft in this ledger, the channel stayed open for three years and five months. Whatever was fixed in 2023, the help request still moved an account to the wrong person in November 2025 — Valve's own sentence.\n\nRestitution tracked attention, not harm. Restored: the biggest inventory in the game, and the collector whose thread trended. Refused: $1,000,000, $6,300,000, $13,000. Valve has never published the rule it applies, because a published rule would have to explain those three.\n\nNobody was told. Not the users whose account histories were read out of the database, not a supervisory authority, not the market that bought the items in good faith and had them clawed back. There is no breach notice, no incident report, no count of affected accounts — and the proceeds left as money, through marketplaces that pay in cash and crypto. A trade reversal cannot follow money out of Steam.\n\nValve holds the support audit trail, the recovery-ticket log and the transaction record for every line above. None of it has been produced. Ask for your own copy →\n\nThe NDA question\nConfidentiality must come with technical accountability.\n\nCompare confidentiality agreements with actual permissions, export controls, reset approvals and access logs. A canned response cannot resolve an allegation that the recovery process itself was abused.\n\nGDPR Articles 28, 32–34\n\nArt. 33 gives a controller 72 hours to notify the supervisory authority of a personal-data breach; Art. 34 requires telling the affected people when the risk to them is high. Valve has confirmed in writing, twice, that its support channel handed accounts to the wrong people — account history, billing records and all. No notification under either article has been published, and no affected user has reported receiving one. Read the regulation ↗ archived 2026-09-20 ↗\n\nInclude support access in your request →\nPart C — Legal frameworks · Section 15 · Commercial scale\nFollow the money. Separate the transactions.\nContext & source limits\n\nThe commercial-use question becomes sharper when the money flows are separated. Third-party item transfers, Valve's primary sales and external cash-outs are different transactions.\n\nThe item is Valve's. The inventory is Valve's. The transfer runs on Valve's servers. Only the payment happens somewhere else — which is the step that decides whether anyone is a money transmitter, and the one step Valve does not operate.\n\nThe revenue mechanism\nWhere the money actually moves.\nThree paths / one item economy\n01 / AccountUser inventory\n\nItems held on Steam\n\n02 / TransferP2P trade\n\nUser ↔ bot or user ↔ user\n\n03 / SettlementExternal platform\n\nSite balance or payment off Steam\n\nCirculationThe economic engine extends beyond a transfer fee\n\nSteam supplies the inventory and transfer infrastructure used by outside markets. The investigation's economic argument is that resale liquidity and repeated demand sustain spending on cases, keys and replacement items, with fees on subsequent Community Market sales. A direct P2P transfer carries no Community Market commission; that accounting fact does not settle the wider benefit. Valve retains control over account access and trading restrictions throughout.\n\n01 / Secondary demandLiquidity & resale value\n\nExternal trading and gambling demand\n\n02 / Primary spendingKeys, cases & capsules\n\nPurchases from Valve where offered\n\n03 / RevenuePrimary-sale income\n\nPlus fees on actual Market sales\n\n5% + 10%Steam + CS2 fee on Community Market sales\n\nThe investigation's economic inference: liquid resale markets can encourage spending on new items. The familiar 15% combines Market fee rates, subject to minimums and rounding; it is not a levy on every external trade.\n\nValve's Community Market fee schedule ↗ archived 2026-09-21 ↗. On 25 February 2026 the New York Attorney General filed an action archived 2026-09-01 ↗ alleging that paid loot boxes are connected to external cash resale and gambling harm — the same connection this dossier documents from the technical-infrastructure side. That complaint is an allegation, not a finding; it is cited here because a state law-enforcement agency has put to Valve a question adjacent to the one this dossier asks: where is the enforcement record that matches the public declarations?\n\n01 / EntryCrypto deposit\n\nExternal service and wallet records\n\n02 / ConversionBalance → skins\n\nItems delivered through Steam trades\n\n03 / ExitExternal fiat sale\n\nSeller, buyer and payout provider\n\nKYC?Identify the control at every handoff\n\nThis is the route to investigate, not a native Steam API cash-conversion service. Document identity checks, custody, transaction IDs and payout recipients at each external operator before asserting a no-KYC cash-out.\n\nUnited States / Bank Secrecy Act\nClassify the activity, then the obligation.\n\nFinCEN assesses money transmission by what a business does. Accepting and transmitting convertible virtual currency can trigger money-services obligations, subject to the applicable definitions and exceptions. Valve's Steam Wallet accepts funds and converts them to in-game items; those items are then liquidated through third-party operators for real currency. The item and its transfer run on Valve's infrastructure; the cash-out does not, and whether any part of that cycle meets the money-transmission definitions is a classification question for FinCEN, not a conclusion drawn here.\n\nFinCEN FIN-2019-G001, §§ 1–2, 5.1 ↗ archived 2025-07-11 ↗\n\nEuropean Union / money laundering\nTrace proceeds, knowledge and assistance.\n\nDirective (EU) 2018/1673 covers intentional laundering and participation involving criminal proceeds. The investigative question is what Valve knew about the operators using its trading and OpenID infrastructure after 13 July 2016, when it publicly described that use, and what it did about them. Valve has published no per-operator enforcement record; that record, not this dossier, would answer the question.\n\nEU criminal-law framework ↗\n\nAMLD6 terminology: the criminal-law directive above is distinct from Directive (EU) 2024/1640, also called AMLD6. The latter has a general transposition deadline of 10 July 2027, with specified exceptions. Article 78 ↗ archived 2026-08-30 ↗\n\nPart C — Legal frameworks · Section 16 · Notice, response, responsibility\nThe Digital Services Act: put knowledge on the record\nContext & source limits\n\nTwo elements of an Article 16 notice sit with the submitter rather than with this dossier: the submitter's own details and a statement of good faith that the information is accurate. Everything else the Article requires — the substantiated explanation and the exact electronic location — is set out in Section 3 and in the route register, with saved responses and hashes, so that any party can lodge it. Two further limits on the law itself: losing the hosting exemption does not by itself establish liability under any other law, and the 6% in Article 52(3) is a statutory ceiling, not an assessed penalty against Valve.\n\nUnder the DSA a hosting provider keeps its liability shield only until it has specific knowledge and fails to act. This dossier is that notice. It names the hosts, the dates, the saved responses and the hashes. From publication the question is no longer whether Valve knew — it is what Valve did next.\n\n01July 2016 / the dossier exhibit\nA ten-day demand.\n\nThe notice reconstructed above is the historical starting point for the investigation's enforcement comparison.\n\n0217 February 2024 / general application\nThe DSA time window.\n\nSeparate historical conduct from conduct during the period when the relevant DSA obligations apply.\n\n03Ten years / original dossier snapshot\nDuration needs a notice trail.\n\nThe elapsed time since July 2016 (see Section 11) is a dossier metric. It is not ten years of established DSA violations. Link each notice to a specific item, applicable law, delivery evidence and response.\n\nArticle 52(3) / statutory ceiling6%\nof annual worldwide turnover\n\nMaximum fine for a breach of DSA obligations, using the provider's preceding financial year. This is a legal ceiling, not an assessed penalty against Valve.\n\nArticles 6, 8 & 16 / the legal test\n\nFor relevant hosting services, specific knowledge and failure to act expeditiously can remove the hosting exemption. A sufficiently precise notice can establish knowledge of the particular content. The DSA imposes no general monitoring duty; loss of the exemption does not itself establish liability under another law.\n\nDSA: Articles 6, 8, 16, 52, 53, 93 and recital 17 ↗ archived 2026-09-20 ↗\n\nReview preserved complaints ↗Build the account timeline →Full legal & economic analysis →\nPart C — Legal frameworks · Section 17 · Identity, age, commercial access\nMinors: a Steam login is not an age check\nContext & source limits\n\nNo minor's data appears anywhere in this dossier and none was collected: the authors did not register on, deposit at, or complete a login to any platform named. Anyone building on this section should keep evidence involving a child private and redact identifying details from public exhibits. COPPA is cited here as a children's privacy law with its own scope conditions — audience, actual knowledge, personal data collected — and not as a general gambling-age rule; the 2026 New York complaint is an allegation by a state authority, not a finding.\n\n\"Sign in with Steam\" proves an account exists. It proves nothing about age — and on these sites it is the only gate between a child and a deposit. Read it with Section 3.1: inside the Steam client the warning a browser would show never fires, so the child never sees one.\n\nWhat Steam OpenID providesAccount identity\n\nA verified SteamID used to log in or link an account.\n\n≠\nWhat the operator must establishEligibility to participate\n\nAge, jurisdiction and any required identity checks.\n\nTechnical basis: Steamworks OpenID documentation ↗ archived 2026-09-21 ↗. The documented identity assertion is not a certification that the user may legally gamble.\n\nCOPPA / children under 13\nIdentify the operator and the data.\n\nCOPPA applies to covered child-directed services and services with actual knowledge that they collect personal information from children under 13. It is a children's privacy law, not a universal gambling-age rule. Establish the audience, personal data collected, knowledge and parental-consent process.\n\nFTC: COPPA requirements ↗ archived 2026-09-21 ↗\n\nThe evidence to preserve\nRecord the journey from login to deposit.\n\nPreserve the site's age gate, registration wording, eligibility terms, payment flow and complaint history. Assess each operator separately. Keep any evidence involving a child private and redact identifying details from public exhibits.\n\nA related public enforcement record is the 2026 New York complaint announcement archived 2026-09-01 ↗, which alleges harm to young users from paid loot boxes. It is not a COPPA finding.\n\nPart C — Legal frameworks · Section 18 · GDPR Article 15 request\nThe request. The reply. The missing comparison.\n\nHe asked for four things, one of them the log that would name whoever put an API key on his account. Three days later the ticket was closed with a link to a page that holds none of them — and the sentence used to close it is contradicted by Valve's own lawyers.\n\nWhose account this is · Provenance & Limits\n\nThese screenshots are not PhishDestroy's. They come from an ordinary Steam account holder — one respondent to a short survey run by this project, who filed the request himself and supplied the captures. The account is his, the ticket is his, and the correspondence is between him and Steam Support. This project did not submit the request, holds no account on the platform, and is not a party to this ticket.\n\nOn 16 September 2026 he filed a GDPR/CCPA Article 15 subject access request asking specifically for API-key registration logs, login history with IPs, device authorisation history and trade history. On 17 September agent \"Logen\" referred him to the self-service Account Data page. On 18 September he stated that the requested categories were not on that page and asked for escalation to the Privacy Team or DPO. On 19 September agent \"Kal\" closed the ticket with the same referral. Both screenshots are preserved below (requester e-mail redacted; SHA-256 in steam_tos_assets/screenshot-manifest.json).\n\nHe is a fitting requester for an ordinary reason: his account carries a Steam Web API key he did not create, registered to localhost. When it was created is not known — not to him, and not from anything Valve has made available to him, because the single record that would date it is the API-key registration log, which is exactly the category the closure withheld. The key is not new: it predates his awareness of it by an interval he cannot measure, for the same reason.\n\nOther account holders are filing the same request. Any reply that arrives will be added here on the same terms as these two — ticket number, capture date, SHA-256, requester redacted — whether it supplies the categories or refuses them.\n\nThis project takes no position on why the ticket was closed. No reason was stated in it, and none is inferred here.\n\nThe request. The response. The comparison.FOLLOW THE RECORD\nStep 3 / 3\n\nHe asked for four named categories. The Account Data page he was referred to is Valve's own self-service export, and this project cannot enumerate its contents for someone else's account — so no full category-by-category comparison is published here. What is on the record is his statement of 18 September that the categories were not there, and the closure of 19 September that repeated the referral without addressing them.\n\nTHE REQUESTSpecific categoriesAPI-key, login, device and trade records\nTHE RESPONSEAccount Data referenceInspect the support exchange\nTHE TESTWhat was supplied?Compare each requested category\nScreen 1/2 — Request (16 Sep) and first reply, agent \"Logen\" (17 Sep)\nGDPR ticket HT-2YBP-F7JP-D4VB — request and first response\nSource: help.steampowered.com, ticket HT-2YBP-F7JP-D4VB · captured 16–17 Sep 2026 · requester e-mail redacted 2026-09-21 · File: gdpr-ticket-1.png · SHA-256 da940c731ab9869d226e9d06ccc8a1b393738766b7b0c445a56662623e025a66 (screenshot-manifest.json).\nScreen 2/2 — Escalation request (18 Sep) and closure, agent \"Kal\" (19 Sep)\nGDPR ticket HT-2YBP-F7JP-D4VB — escalation request and closure\nSource: help.steampowered.com, ticket HT-2YBP-F7JP-D4VB · captured 18–19 Sep 2026 · File: gdpr-ticket-2.png · SHA-256 44844ea7b251f7fd7d79f87ee1578a846606a97b9659d3a53b322120c422219b (screenshot-manifest.json).\nClosing response, 19 Sep (verbatim):\n\"The data Steam retains can already be found in your Account Data page. As there's no further information Steam Support can offer, this request will be closed.\"\nNo data supplied · no legal basis for refusal stated · no escalation outcome shown\nThat sentence is false, and Valve's own lawyers prove it. Counsel's letter of 1 October 2025, paragraph 1.9, describes device-level correlation linking one device to dozens of accounts (Appendix A). The same response carried 830 pages of retained records (Appendix B). None of it is on the Account Data page.\nWhy this account asked for the API-key log\n\nHe did not pick those four categories at random. The localhost key on his account is the mark of a script, not of a person typing a real domain into the developer page (Section 5, Section 6). The one record that shows who created it and from where is the API-key registration log. That was the first thing he asked for. That is what the closure withheld.\n\nSource: the account holder, during this project's survey. The ticket screenshots above are hashed; the key page is not published.\n\nAssessment · PhishDestroy\n\nClosing a ticket with the question still open is not an accident here. It is the normal outcome. We hold 16,319 preserved complaint and support records and 354 de-duplicated support exchanges drawn from them. This ticket is one dated, fully captured example of the shape they take.\n\nSupport Ticket — PreservedHT-2YBP-F7JP-D4VB\nRequest typeGDPR Article 15 DSAR\nTicket statusCLOSED 19 SEP 2026 — NO DATA SUPPLIED\nAgents in the exchange\"Logen\" (17 Sep), \"Kal\" (19 Sep)\nFiled16 Sep 2026\nData requestedWho registered the Web API key linked to this account, and from which IP / device / timestamp\nLegal basis citedGDPR Art. 15 — right of access to personal data\nThe legal frame:Article 12(3) gives the controller one month from receipt (extendable with reasons). That period had not expired at publication, and this dossier does not assert a deadline breach. The objection is to the substance: the closing response links to a self-service page but does not show that the four named data categories were produced, and if the controller declines to act, Article 12(4) requires it to state the reasons and the complaint routes. Neither appears in the closing response.\nWhy this specific data matters\n\nThe Web API key event log is the record that shows whether a third party registered a key using a stolen session cookie — the mechanism described in the inventory-theft complaints preserved in this dossier's archive. Disclosing who registered an API key, from which IP, and at what timestamp, would:\n\nAllow the victim to compare the API creation IP against their own login history\nReveal data-centre IPs linked to known phishing / gambling bot infrastructure\nProduce evidence usable in civil or criminal proceedings against the actor\nShow whether the account holder was notified when the key was created\nWhat the record shows: Valve retains device-level and account-correlation records — its counsel's letter of 1 October 2025 describes them (see Appendix A, Evidence Memorandum — Source 1). In ticket HT-2YBP-F7JP-D4VB the same class of records was requested by the data subject and the ticket was closed with a referral to a self-service page that the data subject reported did not contain them. Whether that refusal is lawful is a question for the supervisory authority; the effect is that the person the data concerns does not get it.\nThe exchange — four messages, three days\n\nTwo Steam Support agents replied under first names shown on the ticket: \"Logen\" on 17 September and \"Kal\" on 19 September. Both referred the requester to the Account Data page. Nothing on the ticket shows whether the request reached Valve's Privacy Team or Data Protection Officer, and the dossier does not assert who the agents are, what their roles are, or how the ticket was routed.\n\n16 SEP\nArt. 15 request filed with four named data categories\n17–18 SEP\nReferral to Account Data; requester asks for DPO escalation\n19 SEP\nTicket closed with the same referral; no data, no stated basis\nWhat Article 15 GDPR explicitly entitles the subject to\nArt.15(1)(a)Processing purposes — why Valve holds the data\nArt.15(1)(b)Categories of data — what Valve holds\nArt.15(1)(c)Recipients or categories of recipients — who received the data (e.g., API key holder)\nArt.15(1)(d)Retention period or criteria for determining it\nArt.15(3)A copy of the personal data undergoing processing — i.e., the API-key log itself\nART.12(3)Response required within one month of receipt; an extension must be communicated within that month. The period had not expired at publication. Art. 12(4): if the controller does not act, it must state why and inform the subject of the complaint routes.\nRegulatory complaint pathway — for any user\n\nAny user who submitted an Article 15 GDPR request to Valve and received no compliant response (or a template refusal without data) may file a complaint with the supervisory authority in their EU/EEA member state. Valve's EU establishment is Valve GmbH in Hamburg, so the lead supervisory authority for cross-border complaints is the Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI). (Valve's Article 27 representative is also located in Hamburg; a representative's address does not by itself determine the competent authority.) A complaint may also be filed with the authority of the complainant's own member state under Article 77.\n\nHmbBfDI complaint form ↗ GDPR text (Art. 12, 15, 77) ↗ archived 2026-09-20 ↗EDPB guidelines ↗\n\nTicket reference for any complaint: HT-2YBP-F7JP-D4VB — preserved in this dossier as a documented instance.\n\nOne documented instance\nThe records exist; the data subject did not receive them.\n\nValve's counsel described device-level correlation records in a letter of 1 October 2025. On 19 September 2026 an Article 15 request for the same class of records was closed with a referral to a self-service page the requester reported did not contain them, without a stated legal basis. Ticket HT-2YBP-F7JP-D4VB is one documented instance; whether it reflects a wider practice is a question for the supervisory authority, which can ask Valve for its handling records.\n\nGDPR Articles 12, 15, 77 / Supervisory authority\n\nA complaint under Articles 12 and 15 can be lodged directly with the relevant supervisory authority without cost (Article 77). The authority may impose corrective measures including orders to comply with the access request, and fines under Article 83(5)(b) for infringements of data-subject rights. Preserving the original ticket reference and any Valve response (or its absence) strengthens a complaint.\n\nSee the DSAR template →\nPart C — Legal frameworks · Section 19 · Contract law\nThe Subscriber Agreement against the platform's own architecture\nContext & source limits\n\nThe authors are not lawyers and none of this is legal advice. The SSA is quoted from the revision of 10 September 2026; a different revision may read differently, and clause numbering has changed across revisions — check the clause against the version that governed the conduct in question. The Articles 25 and 32 arguments state what the regulation requires, not that a supervisory authority has found a breach. The figures in Argument 1 carry the scope limits set out in Section 13.\n\nThree of the SSA's central provisions sit awkwardly with how the platform is built: the commercial-use prohibition against a Market price ceiling that pushes high-value sales off-platform; the user-liability clause for API keys against a key endpoint that, before 2023, required no second factor; and the enforcement language against a public record that shows no per-operator enforcement. Whether these tensions affect enforceability is a question for a court; this section sets out the facts a court would have before it.\n\nArgument 1 / Market Cap Architecture\nThe Market ceiling and the commercial-use prohibition\n\nThe Steam Community Market has a listing ceiling of about $1,800. Across five marketplaces in a dated snapshot (23 Sep 2026), 248 CS2 item categories are independently priced above that ceiling by two or more of them; such items cannot be sold at those prices on Valve's own platform. Owners who want those prices use third-party markets, which run on Steam accounts and the Steam API — use that the SSA classes as commercial unless expressly permitted.\n\nItems exceed the Market ceiling → third-party markets fill the gap → those markets use Steam accounts and the Steam API → the SSA prohibits commercial use without permission → no register of permissions has been published. The Community Market's combined fee of about 15% applies only to sales completed inside the Market, not to these external trades.\nArgument 2 / API Key Security Architecture\nThe API-key vulnerability as a platform design question rather than user negligence\n\nBefore 2023, Steam's API key creation endpoint accepted a POST with a stolen sessionid and generated a high-privilege credential without e-mail confirmation, a second factor or device verification. The API hijack complaints collected in this investigation follow one pattern: attacker script, stolen session cookie, silent key creation, trade interception (the request payload is shown in Section 8).\n\nGDPR Article 25 (data protection by design) and Article 32 (security of processing) require technical measures appropriate to the risk. Issuing a credential capable of trade interception without a second factor or owner notification is a design question for the controller. Whether the SSA clause placing liability on the user can be relied on against that background is a question for a court and the supervisory authority.\n\nArgument 3 / Real-Time Visibility\nValve receives the auth hostname on every login\n\nThe auth hostname arrives at Valve's OpenID endpoint in plaintext in openid.return_to and openid.realm (the request shape is shown in Section 3). Extracting it is a standard operation. As of 2026-09-22, in 26 pairs the main domain was on the Link Filter while the host carrying its Steam login was not. Valve has published no per-operator enforcement record, so whether any measure other than the Link Filter has been applied to these hosts cannot be established from public data.\n\nWho bears the cost\nThe pattern in the archived complaints\n\nIn the reviewed complaints, Steam Support's response to an API-key hijack claim follows one form: decline restoration, cite the user's responsibility for the account and its API key, close the ticket. No aggregate figure for accounts affected or value lost is estimated in this dossier; no source for such a figure has been located.\n\nThe question is not whether individual users made mistakes. The question is who is responsible for an architecture that, until 2023, allowed a POST request with a stolen cookie to create a high-privilege trading credential with no notification and no second factor.\nThe SSA as a document vs the SSA as a contract\nA court evaluating this record would not read the SSA in isolation.\n\nIt would read it alongside counsel's October 2025 letter describing device-level correlation, the auth-host registration dates, the batch registration timestamps, the API-key request payload, and the ten years between the July 2016 notices and the platforms still operating in September 2026. That is the record Valve would have to address.\n\nSSA against the record / key points\n\"No commercial use\" — the Market ceiling pushes high-value sales to commercial third-party markets\n\"Users liable for API keys\" — no second factor on the key endpoint before 2023\n\"We enforce against violators\" — no per-operator enforcement record published since July 2016\n\"You agreed to terms\" — in the hijack pattern the acceptance is submitted by a script, not the account holder\nConclusion · What the record establishes and what we ask\nThe findings. The records we ask for.\nContext & source limits\n\nEach finding below is tied to a dated public record in the sections above. The requests are addressed to the authorities that can compel the one thing this investigation cannot reach: Valve's own enforcement, access and processing records.\n\nEach request follows a dated finding. The authorities can seek records that this public-source investigation cannot compel.\n\nWhat the public record establishes\n44 live platforms authenticate through a separate registrable domain — 27 with a published per-route evidence file, 17 from manual collection and listed apart. As of 2026-09-22, 26 pairs had the main domain blocked in the Steam Link Filter while the host carrying its login was not — csgogem.com blocked, api.csgem.com registered since March 2014. Steam receives that hostname in openid.realm and openid.return_to on every login. Section 3\nOn 13 July 2016 Valve publicly named the mechanism and prohibited it, and its counsel's notices of 20 July 2016 set a ten-day deadline. No per-operator enforcement record has been published in the ten years since that deadline. Section 11\nThe Steam Web API key endpoint issued a high-privilege, trade-capable credential from a session cookie alone, with no second factor before 2023. Section 5\nA GDPR Article 15 request (ticket HT-2YBP-F7JP-D4VB) was closed after three days with a link to self-service and no data. Section 18\nWhat we ask each authority\nWashington State Gambling Commission\nReopen the 2016 file. Request an operator-by-operator account of which accounts, bots and return hosts were disabled after the ten-day notices, and which operators later regained access. Section 2\nHmbBfDI (Hamburg; Valve GmbH)\nTest whether the Article 15 response met the controller's duty, and require disclosure of the API-key registration and access records relevant to identifying the actor. Section 18\nDSA digital-services coordinators\nPut the auth-host routing on the record as notice, then assess whether Valve's response meets its obligations once knowledge is documented. Section 16\nAny data subject\nUse the Article 15 template to request the same records for your own account; a retained record can test who initiated a reset or created a key. Appendix G\n\nThe single request behind all four is the same: publish the enforcement, access and processing records that only Valve holds. A homepage warning, a ten-day letter and a self-service page are assertions of control. Whether control was exercised is a question the public record cannot answer and a regulator can.\n\nAppendices — primary exhibits and working materials\nAppendix A — Counsel correspondence\nEvidence Memorandum — material provided by Source 1\n\nEvidence base and source status for the counsel correspondence relied on in Sections 1, 18 and 19.\n\nEvidence Base and Source Status — documents provided by Source 1\nThe user whose permanent ban triggered this audit is not the subject of it. Whether that ban was justified is not examined here, and this dossier neither defends nor disputes it. The account is not the point. What matters is the material: Source 1 — the banned account holder, who received the correspondence below from Valve's counsel as the data subject of their own GDPR request — passed on that correspondence and the accompanying case files, together with the right to examine them publicly. The name is withheld; the documents are described by date, producer metadata and hash.\n\nThat correspondence was sent in response to a GDPR/DSAR request. In the course of it, Valve's counsel put a statement on the record, under signature, describing a capability that Steam Support had previously told users was not technically possible. The paragraph quoted below is that statement.\n\nThe authors' further analysis of the produced log extract is withheld from this dossier pending independent review. It is not relied on by any other part of this investigation.\n\nThe admission on the record: persistent device-level telemetry\n\nIn paragraph 1.9 of the letter attributed to Valve's counsel, Valve's attorneys state: \"Between 2019 and 2023, this account was used primarily from a device that was also used to log into dozens of stolen Steam accounts.\"\n\nThe Fact: Valve's counsel here describes device-level correlation across accounts spanning four years. Steam Support has told theft victims that tracking stolen items or linking accounts to devices was not technically possible. Steam Guard device authorisation is publicly documented, so the existence of per-device records is not itself new; what is new is counsel's written confirmation that those records are retained and correlated across accounts over multi-year periods.\n\nWhy this matters: the correlation that can link one device to dozens of hijacked accounts over four years is the same class of record Support said it could not use for victims. Records of that class would be capable of identifying accounts and devices in a theft-and-resale chain. Which records exist, how long they are retained, and on what basis they are withheld from data subjects are the questions for the supervisory authority.\n\nSource: letter of Valve's counsel dated 1 October 2025, paragraph 1.9, and its 830-page PDF appendix · received by Source 1 in response to a GDPR Art. 15 request · SHA-256 of the appendix recorded in disclosure-audit.json · the letter itself is not reproduced; account names and third-party data are omitted.\n\nStatus: open\nSource materials are available through the evidence archive.\nAppendix B — The produced PDF · redaction check\nThe redaction in the produced PDF is cosmetic: the covered text remains extractable\n\nValve's counsel answered a GDPR access request with an 830-page appendix in which the redactions are painted over the text rather than removing it. 902,270 characters sit under the black bars and come straight out with a text-extraction tool — including the third-party identifiers the bars were there to withhold. Only aggregate counts are published here; no covered content is reproduced, and the appendix itself is not published.\n\n1. What the geometry check found\n\nThe GDPR Art. 15 response dated 1 October 2025 was accompanied by an 830-page PDF appendix (Aspose.PDF for .NET producer metadata, created and modified on the same date). The authors ran a page-level geometry check: for each page, opaque near-black rectangles painted after the text layer were located and the extractable characters lying beneath them were counted.\n\nMeasured on the produced file\n902,270\nCharacters still extractable from under the black bars\nCounted, not estimated. This is a count of covered characters — not of victims, re-identifications or incidents.\n830 / 830\nPages affected — every page\n986\nRectangles over extractable text\n1,329\nOpaque black rectangles in total\nThe black bars are drawn over the text layer; they do not remove it. Text under the bars can be extracted with standard PDF tools. Only aggregate counts are published; no covered content is reproduced here.\nForensic Demonstration: Layer Separation\nASPOSE.PDF FOR .NET VECTOR OVERLAY MOCKUP (APPENDIX P. 412)\n\nReport filed against account: [LOGIN: redacted_user_667]\n\nReason submitted by user: [TEXT: \"User reports duplicate items in inventory and abusive trade conduct...\"]\n\nForeground: <path fill=\"#000\" />Flaw: Underlying UTF-8 stream intact\nSource: PDF appendix to the counsel letter of 1 October 2025 (830 pages, Aspose.PDF for .NET producer metadata) · measured by the authors, method and per-page counts in disclosure-audit.json · SHA-256 of the appendix recorded in the same file · the appendix itself is not published.\n2. Why this matters for a data-subject response\n\nValve's counsel sent this file to a data subject in answer to a request for that person's own records. The bars on it are cosmetic: the text underneath was never removed, so the third-party identifiers the bars were applied to withhold went to the recipient along with the file. A redaction that lifts with a text-extraction tool withholds nothing, and it also leaves the recipient unable to establish what was disclosed and what was not.\n\nArticle 15(4) is the reason those bars exist at all: the right to obtain a copy must not adversely affect the rights and freedoms of others. That is the obligation this production did not meet. Whether it is characterised as a personal data breach under Art. 4(12) is for the supervisory authority to determine; the disclosure itself is measurable in the file, and reproducible by anyone holding the same bytes — the SHA-256 is published, the appendix is not.\n\nWhat was under the bars was not account numbers. It was the body of user reports filed against the requester, with their authors attached: Steam logins that, because a login is rarely used only on Steam, identify the person behind them — on the authors' count, over 60% of the users named in the document are fully identifiable — together with the raw, unredacted text of what they wrote. That text includes death wishes and abuse directed at the requester's nationality. Some of the people so identified are minors. The production handed a named list of reporters to the person they had reported, which is the precise harm Art. 15(4) is written to prevent.\n\nThe sequence around the file matters as much as its contents. The request was met first with a demand for further proof of identity, on the ground that the requester's alias email address did not contain his name; the account was permanently banned during the delay that followed. The letter that finally delivered the data, more than six weeks past the Art. 12(3) month, threatened the recipient with criminal prosecution and withheld the remainder of his own data until he explained his account activity to counsel. The disclosure also settles two questions Valve has not answered in public: the records produced show account-linking reaching back to 2019, and internal telemetry of a depth Valve has never described.\n\nScope of this section: the observation here is limited to the mechanics of the redaction, measured on the file as produced. The authors' further analysis of the produced logs is withheld pending independent review and is not relied on elsewhere in this dossier.\n\nEvidence: counsel letter of 1 October 2025 and its PDF appendix (SHA-256 recorded in the audit file); page-level PDF measurements and method ↗. The sequence of the request, the page-8 refusal and the characterisation of the exposed records are set out in full in PhishDestroy's account, “My Dog vs. Elite GDPR Lawyers”, 17 August 2026 ↗ archived 2026-08-21 ↗. Account names and third-party data are omitted here; nothing covered by the bars is reproduced.\n\nPage 8 of the covering letter refuses part of the request, and states the reason in writing: Eine genauere Auskunft ist aufgrund des Schutzes der personenbezogenen Daten anderer Nutzer der Steam-Plattform… nicht möglich. — a more detailed answer is not possible, because the personal data of other Steam users must be protected. The 830-page appendix was in the same package. What the bars covered was not account numbers: it was the reports filed against the requester, their authors named, with the raw unredacted messages attached. The account holder had asked Valve, through its counsel, for his own file; what he could extract from it was other people's. Nothing in this appendix turns on who drew the boxes. What it establishes is that the protection Valve invoked as its ground for withholding is the protection this same production failed, in the same envelope, on the same day.\nSupport and Legal Correspondence Exhibits\n\nSource: https://phishdestroy.io/steam_dossier/index#exhibit-gallery-section\n\nAppendix D — Source collection\nSelected primary records\n\nSix records from the archive — three GitHub issues in Valve's trackers and three Reddit accounts of disputed support outcomes. Each source stays attached to the claim, the saved text and the question it raises.\n\n1 / 6 selected records\nChoose a source record\nGH-01 / GITHUBOpen in saved build\nHardware keys, requested in 2016\n\nValveSoftware / steam-for-linux · #4521 · 2016-06-27\n\nA user asked Valve to support U2F hardware keys as an alternative second factor. The saved issue carries both Feature Request and reviewed labels, with its state recorded as open.\n\nI request U2F usb dongle support in steam as an alternative.\n\nExcerpt from the GitHub issue ↗\nDocumented record\nA dated request for an additional account safeguard, published in Valve's own issue tracker and labelled reviewed.\nAccountability demand\nPublish the product decision, the response date and the protection delivered after review.\nRead saved record →Open GitHub ↗\nIn the dossier: Account safeguards →Archive #484 · build 2026-09-17\nGH-02 / GITHUBOpen in saved build\nCrash reports without an effective opt-out\n\nValveSoftware / steam-for-linux · #6459 · 2019-08-18\n\nThe reporter describes a Steam client from 12 August 2019 on Ubuntu 16. They say disabling the crash-upload destination did not persist after a restart, and include the relevant configuration.\n\nIf I disable the `ServerURL`, it gets overwritten after every reboot.\n\nExcerpt from the GitHub issue ↗ archived 2026-04-19 ↗\nDocumented record\nA specific privacy complaint with a client date, operating system and configuration excerpt. The saved issue is open.\nAccountability demand\nIdentify the investigation, the affected builds and the change that made the opt-out effective.\nRead saved record →Open GitHub ↗archived 2026-04-19 ↗\nIn the dossier: Request the underlying records →Archive #467 · build 2026-09-17\nGH-03 / GITHUBOpen in saved build\nAuth-ticket abuse reported to Valve\n\nValveSoftware / Source-1-Games · #3857 · 2022-02-26\n\nThe author alleges that a server operation retained Steam authentication tickets after players disconnected and used misleading server listings. The post asks Valve to address the behavior.\n\nMaking their servers look packed.\n\nExcerpt from the GitHub issue ↗\nDocumented record\nA public abuse report lodged in Valve's tracker on 26 February 2022. Its saved state is open; the report includes links to screenshots.\nAccountability demand\nProduce the investigation result and the mitigation record for the reported authentication-ticket abuse.\nRead saved record →Open GitHub ↗\nIn the dossier: Dataset scope →Archive #768 · build 2026-09-17\nRD-01 / REDDITAuthor's account\n44 disputed Market purchases\n\nr/DotA2 · author handle withheld · 2022-07-07\n\nThe author reports 44 unauthorized Market purchases on 6 July 2022 and roughly $500+ in losses. They say two-factor authentication was enabled and describe repeated template replies from support.\n\n2nd ticket in and I have still yet to receive a non robotic copy paste template response from Steam.\n\nExcerpt from the Reddit post ↗ archived 2025-03-20 ↗\nDocumented record\nA dated account of disputed purchases, with links to transaction screenshots and a support response. The amounts and events are the author's report.\nAccountability demand\nReconcile the disputed purchases with transaction and session logs. Explain the evidence behind support's decision.\nRead saved record →Open Reddit ↗archived 2025-03-20 ↗\nIn the dossier: Support and enforcement →Archive #4,533 · build 2026-09-17\nRD-02 / REDDITAuthor's account\nA permanent ban and closed appeals\n\nr/ohnePixel · author handle withheld · 2024-12-09\n\nThe author disputes a permanent ban and says support cited suspected account transfer and community reports. They describe closed tickets and plans to request their personal data.\n\nI explained my situation and asked for more details, but they're sticking to their decision and closing my tickets.\n\nExcerpt from the Reddit post ↗\nDocumented record\nA preserved appeal account, including the reasons the author says support supplied and links to four images. The post date comes from the selected support export.\nAccountability demand\nIdentify the evidence supporting the permanent ban and the review available to challenge it. Closing an appeal does not explain the decision.\nRead saved record →Open Reddit ↗\nIn the dossier: Request the underlying records →Archive #4,766 · build 2026-09-17\nRD-03 / REDDITAuthor's account\nA recovery reset and a reported $10,000 loss\n\nr/legaladvice · author handle withheld · 2025-05-09\n\nThe author alleges that support reset credentials and disabled account protections after someone else submitted a recovery ticket. They report a loss of about US$10,000 from an inactive account.\n\nSteam Support reset my password and turned off all my account security.\n\nExcerpt from the Reddit post ↗\nDocumented record\nA preserved allegation about the recovery process overriding account safeguards. The saved post records what the author says support told them.\nAccountability demand\nIdentify who authorised the reset, the ownership evidence they accepted and the access log. Account recovery is part of the security system Valve controls.\nRead saved record →Open Reddit ↗\nIn the dossier: Request the underlying records →Archive #4,592 · build 2026-09-17\n\nSix selected records. GitHub states describe the saved build. Reddit posts preserve the authors' accounts.\n\nDownload the six records ↓\n\nThe searchable build contains 16,319 distinct records: 393 Trustpilot, 5,635 Reddit, 2,395 GitHub, 276 web and 7,620 wiki records. Multiple records can concern the same event. The separate 40,448-row master export has a different scope.\n\nSearch the full archive ↗ · Build manifest ↗ · Dataset scope and counts →\n\nAppendix E — Case study\nArchiSteamFarm and the automation clause\n\nAn open-source card-farming tool whose own FAQ states it runs on millions of accounts, set against the Subscriber Agreement clause (§ 4.C) that prohibits automation. The mechanics — what a farm has to buy from Valve before it can produce anything, why every way of cashing out a card breaches the licence, the enforcement record and who moderates the card economy — are set out in full in Exhibit V ↗.\n\nThe Steam Subscriber Agreement, § 4.C, states:\n\n\"You may not use any form of scripts, bots, macros, or other non-human-controlled systems ('Automation') to interact with Content and Services on Steam in any manner.\" — Steam Subscriber Agreement § 4.C (current) ↗ archived 2026-09-18 ↗\n\nValve enforces this clause. It is very good at it. The FAQ of ArchiSteamFarm (ASF) — an open-source tool its own documentation describes as running on more than a few million Steam accounts since a first release over 11 years ago — reproduces three Steam Support messages permanently banning users who ran bot networks. Valve found the networks, named them and killed them. The relevant question is therefore not whether Valve can detect automation at scale.\n\nThe project's official ArchiSteamFarm FAQ addresses the risk of a ban directly:\n\n\"This is extremely unlikely considering the fact that ASF is being used on more than a few million of Steam accounts, since its first release that happened over 11 years ago — but still a possibility, regardless of actual probability.\"\n\n\"Valve clearly acknowledges 'Steam idlers' existing, as stated here, so if you asked me, I'm pretty sure that if they weren't fine with them, they'd already do something instead of pointing out that they could cause problems VAC-wise. The key word here is Steam idlers, for example ASF, and not game idlers.\"\n\n— ArchiSteamFarm FAQ, JustArchiNET. Source: GitHub wiki ↗ · verified verbatim 2026-09-22\n\nThe same FAQ answers \"Did anybody get banned for it?\" with Yes, and reproduces what Steam Support wrote to three of them:\n\n1,000+ bots · trade banned\n\"It looks like this account was used to manage a network of bot accounts. Botting is a violation of the Steam Subscriber Agreement.\"\n\n170+ bots · permanently banned, 2017 Winter Sale\n\"this account was used to illegally collect collectible cards on Steam, as well as related and not only commercial activities. The account has been permanently blocked and Steam Support can not provide additional support on this issue.\"\n\n120+ bots · permanently banned\n\"This and other accounts were used for flooding our network infrastructure, which is a violation of Steam online conduct.\"\n\n— Steam Support messages reproduced in the ArchiSteamFarm FAQ, section \"Did anybody get banned for it?\". Source ↗ · verified verbatim 2026-09-22\n\nPut the two records side by side. A private user with 1,000 farming bots is identified, told that \"botting is a violation of the Steam Subscriber Agreement\", and permanently removed. The commercial platforms in this dossier run automated Steam accounts as their core business, at far greater scale, and authenticate through Valve's own OpenID on every login — and no per-operator enforcement record has been published for any of them. The clause works. The question is who it is pointed at.\n\nASF is not accused of anything here, and its reading of Valve's position is its own — its author states plainly that \"ASF is not authorized by Valve\". The tool is used here as a measuring instrument: it shows that Valve detects bot networks, names them in writing and bans them permanently. Valve can close the question in one sentence by publishing which commercial automation it authorises, and the per-operator record of what it did about the rest.\n\nWhere card farming touches Valve's revenue\n\nFarmed trading cards are sold on the Steam Community Market, which charges a combined fee of about 15% on each sale completed inside the Market; the account must have spent $5.00 USD on Steam before it can receive a card at all; and card drops require game ownership or in-game purchases. No aggregate revenue figure is estimated here — the operating scale is stated only as the ASF FAQ states it. The FAQ also records Valve distinguishing \"Steam idlers\" (card farming) from \"game idlers\"; see the ASF FAQ ↗. The mechanics are set out in full in Exhibit V — the scale and the commercial-use trap.\n\nSubjectArchiSteamFarm — automated card farming\nStated scaleMillions of accounts (per ASF FAQ — exact active count unverified)\nCounted, not quoted10,880,610 total API entries in ASF's own Steam group (5,360,499 non-limited, as Steam displays) — the FAQ's \"millions\" is not a story, it is a headcount. 88.97% carry no Steam ban of any kind. The full ban census ↗\nDisclosures in the tool's own documentation\nASF logs accounts in headlessly and idles games for card drops without launching the Steam client (per the project documentation).\nThe FAQ reasons that Valve is aware of \"Steam idlers\" and that \"if they weren't fine with them, they'd already do something\".\nNo targeted enforcement reported in over 11 years (per the FAQ); the resulting card sales inside the Community Market carry Steam's combined fee of about 15%.\nThe FAQ states a recommended ceiling of ten accounts per operator and attributes it to Valve: \"This recommendation is based on internal Valve guidelines, as well as our own suggestions.\" No such guideline is published by Valve.\nTechnical ceiling, per the same FAQ: \"you can run up to 100-200 bots with a single IP and a single ASF instance.\"\nFarmed playtime is recorded by Valve — \"it's usually updated every 30 minutes or so\" — and § 4.C lists \"Faking gameplay statistics (e.g., inflated wins or losses, XP, playtime)\" as a prohibited act.\nSources\nOfficial JustArchi ASF FAQ wiki ↗ ArchiSteamFarm repository ↗ archived 2026-09-24 ↗\nThe automation clause is explicit; the ASF FAQ has stated for years that the tool runs on millions of accounts; no targeted enforcement against it has been reported. The gap between the rule and its application is the record; the reason for it is not established here.\nFull exhibitThe card economy: the process, the scale, the licence and who moderates it ↗What a farm has to buy from Valve before it can produce a single card; the two lines of § 4.C that name card farming by its effects; why every way of cashing a card out breaches the licence Valve wrote while Valve charges a fee at the door; the enforcement record including the June 2025 VAC wave and chain-banning by shared phone number; and the Valve employee and community moderators found administering the card-trading and ban-list services around Steam.The ban censusWe didn't ask Valve how big the farm is. We counted it. ↗10,880,610 total accounts (limited and non-limited) read from ArchiSteamFarm's own Steam group, which the software auto-joins by default on first launch unless the user unchecks the group-join setting (capturing both commercial bot farms and regular players who left the default on). 88.97% carry no Steam ban of any kind; of the 11% that do, 99.8% are cosmetic community bans that never stop trading. Cross-checked against SteamRep, 67.77% of listed scammers walk free once anti-cheat bans are set aside. With registration-date, geography and survival breakdowns — the real scale, measured, not narrated.\n\nAppendix F — Working ledger\n\nRules ledger: clauses against recorded platforms\n\nChoose a rule; the register lists the recorded platforms tagged under it, with their main domain, declared auth host and saved Link Filter result. A blocked website, another domain for sign-in: follow the rule through to the route that remains.\n\n175records linked\nto this rule\n174 primary domains0 C&D mentions\nRULE EXCERPT / SSA § 2.G\nCommercial Use & Account Charging\n“…exploit the Content and Services or any of its parts for any commercial purpose, except as expressly permitted elsewhere in this Agreement (including any Subscription Terms or Rules of Use).”\nFOLLOW THE RECORDS\nPlatform register 175\nScale figures are source estimates\n\n175 of 175 records\n\nService / parent group\tMain domain / registry\tObserved auth domain / age\tScale / recorded response\n\nCasino\n\tcsgoempire.com\n11.3 yearsRegistered 2015-06-10\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ncsgoempirelogin4.com\n6.2 yearsRegistered 2020-07-20\nRDAP ↗\nSEPARATE DOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Roulette\n\trustreaper.com\n23.2 yearsRegistered 2003-06-24\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nrustreaper.com\n23.2 yearsRegistered 2003-06-24\nRDAP ↗\nSAME HOSTSame hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Casino\n\trustly.com\n12.4 yearsRegistered 2014-05-06\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nrustly.com\n12.4 yearsRegistered 2014-05-06\nRDAP ↗\nSAME HOSTSame hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRoulette Casino\n\tcsgofast.com\n11.5 yearsRegistered 2015-03-27\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nsteam-login.authtofast.com\n83 daysRegistered 2026-06-30\nRDAP ↗ · authtofast.com (parent)\nSEPARATE DOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCrypto Casino\n\tduelbits.com\n6.6 yearsRegistered 2020-02-03\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nswitchflips.com\n6.4 yearsRegistered 2020-04-21\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opener\n\tfarmskins.com\n10.5 yearsRegistered 2016-03-23\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nsteam.kobal.cc\n9.7 yearsRegistered 2017-01-07\nRDAP ↗ · kobal.cc (parent)\nSEPARATE DOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tcsgoluck.com\n9.3 yearsRegistered 2017-05-18\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ncsgoluck.com\n9.3 yearsRegistered 2017-05-18\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Roulette\n\tinsane.gg\n7.5 yearsRegistered 2019-04-02\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.insane.gg\nRegistry date unavailableRegistry date unavailable\nOWN SUBDOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tcs2skin.com\n3.5 yearsRegistered 2023-03-06\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ncs2skin.com\n3.5 yearsRegistered 2023-03-06\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tjuice.gg\n7.9 yearsRegistered 2018-10-19\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nletmeinjuice.com\n2.4 yearsRegistered 2024-04-15\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\tggdrop.com\n8.6 yearsRegistered 2018-02-23\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nggauth.com\n3.4 yearsRegistered 2023-05-03\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkins Casino\n\thowl.gg\n9.5 yearsRegistered 2017-03-16\nWHOISFREAKS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nhowl.uno\n41 daysRegistered 2026-08-11\nRDAP ↗\nSEPARATE DOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tchicken.gg\n5.7 yearsRegistered 2021-01-11\nWHOISFREAKS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nchicken.gg\n5.7 yearsRegistered 2021-01-11\nWHOISFREAKS ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tcsgocasino.gg\n2.6 yearsRegistered 2024-02-17\nWHOISFREAKS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.csgocasino.gg\n2.6 yearsRegistered 2024-02-17\nWHOISFREAKS ↗ · csgocasino.gg (parent)\nOWN SUBDOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkins Casino\n\thunt.gg\n6.9 yearsRegistered 2019-11-04\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.hunt.gg\nRegistry date unavailableRegistry date unavailable\nOWN SUBDOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Battles\n\tcsbattle.com\n9.8 yearsRegistered 2016-12-10\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ncsbattle.com\n9.8 yearsRegistered 2016-12-10\nRDAP ↗\nSAME HOSTSame hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tskinrave.gg\n3.1 yearsRegistered 2023-08-16\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.skinrave.gg\nRegistry date unavailableRegistry date unavailable\nOWN SUBDOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tcsdouble.gg\n261 daysRegistered 2026-01-03\nWHOISFREAKS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ncsdouble.gg\n261 daysRegistered 2026-01-03\nWHOISFREAKS ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Roulette\n\trustchance.com\n8.0 yearsRegistered 2018-10-03\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nhgfuihd.com\n7.6 yearsRegistered 2019-01-27\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Automation\n\tcobaltlab.tech\n3.5 yearsRegistered 2023-03-30\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ncobaltauth.com\n1.7 yearsRegistered 2025-01-07\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Roulette\n\traided.gg\n171 daysRegistered 2026-04-03\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.raided.gg\n171 daysRegistered 2026-04-03\nIP2WHOIS ↗ · raided.gg (parent)\nOWN SUBDOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Casino\n\trustneo.gg\n1.3 yearsRegistered 2025-06-20\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nrustneo.gg\n1.3 yearsRegistered 2025-06-20\nIP2WHOIS ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tsplits.gg\n3.7 yearsRegistered 2023-01-23\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nsplits.gg\n3.7 yearsRegistered 2023-01-23\nIP2WHOIS ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Upgrader\n\tupgrader.pro\n1.2 yearsRegistered 2025-07-02\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nupgauth.space\n38 daysRegistered 2026-08-14\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tskin.fans\n8.2 yearsRegistered 2018-07-13\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nauth.skinfans.com\nRegistry date unavailableRegistry date unavailable\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\thotpizza.one\n1.8 yearsRegistered 2024-12-07\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nhotpizza.one\n1.8 yearsRegistered 2024-12-07\nRDAP ↗\nSAME HOSTSame hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\tg4skins.com\n10.1 yearsRegistered 2016-08-09\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nauth.g4s.to\nRegistry date unavailableRegistry date unavailable\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTF2 Gambling\n\ttf2royal.com\n4.1 yearsRegistered 2022-08-17\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ntf2auth.com\n5.2 yearsRegistered 2021-07-27\nRDAP ↗\nSEPARATE DOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTF2 Gambling\n\ttf2hunt.com\n8.7 yearsRegistered 2018-01-13\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nrstspcl.com\n6.1 yearsRegistered 2020-08-08\nRDAP ↗\nSEPARATE DOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTF2 Gambling\n\ttf2.bet/coinflip\n8.4 yearsRegistered 2018-05-06\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ntf2.bet\n8.4 yearsRegistered 2018-05-06\nRDAP ↗\nSAME HOSTSame hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\topenstars.gg\n131 daysRegistered 2026-05-13\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nopenstars.gg\n131 daysRegistered 2026-05-13\nIP2WHOIS ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCS2 Market\n\tskins.com\n25.1 yearsRegistered 2001-08-08\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.skins.com\n25.1 yearsRegistered 2001-08-08\nRDAP ↗ · skins.com (parent)\nOWN SUBDOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nP2P Market\n\twhite.market\n9.6 yearsRegistered 2017-03-01\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nwhite.market\n9.6 yearsRegistered 2017-03-01\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nP2P Market\n\tmoon.market\n7.6 yearsRegistered 2019-02-27\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nmoon.market\n7.6 yearsRegistered 2019-02-27\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nP2P Market\n\tcsfloat.com\n5.2 yearsRegistered 2021-07-11\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ncsgofloat.com\n11.0 yearsRegistered 2015-09-29\nRDAP ↗\nSEPARATE DOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkins Market\n\tskin.land\n4.7 yearsRegistered 2022-01-21\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nauth.skin.land\nRegistry date unavailableRegistry date unavailable\nOWN SUBDOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkins Market\n\thaloskins.com\n2.8 yearsRegistered 2023-12-10\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nhaloskins.com\n2.8 yearsRegistered 2023-12-10\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCorporate Market\n\tbuff.163.com\n29.0 yearsRegistered 1997-09-15\nRDAP ↗ · 163.com (parent)\nOpen Steam Link Filter ↗Filter status is a separate check\t\nbuff.163.com\n29.0 yearsRegistered 1997-09-15\nRDAP ↗ · 163.com (parent)\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nP2P Marketplace\n\tmarket.csgo.com\n26.6 yearsRegistered 2000-02-07\nRDAP ↗ · csgo.com (parent)\nOpen Steam Link Filter ↗Filter status is a separate check\t\ndota2.net\n14.9 yearsRegistered 2011-10-29\nRDAP ↗\nSEPARATE DOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRegulated Market\n\tskinport.com\n8.0 yearsRegistered 2018-09-05\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nskinport.app\n6.3 yearsRegistered 2020-06-20\nRDAP ↗\nSEPARATE DOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nMarketplace/Swap\n\tskinflow.gg\n3.8 yearsRegistered 2022-11-26\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.skinflow.gg\nRegistry date unavailableRegistry date unavailable\nOWN SUBDOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkins Market\n\tskin.place\n6.0 yearsRegistered 2020-09-23\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.skin.place\nRegistry date unavailableRegistry date unavailable\nOWN SUBDOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nInstant Swap\n\tskinsmonkey.com\n5.7 yearsRegistered 2021-01-06\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nskinsmonkey.com\n5.7 yearsRegistered 2021-01-06\nRDAP ↗\nSAME HOSTSame hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCorporate Market\n\tskinbaron.de\nRegistry date unavailableRegistry date unavailable\nOpen Steam Link Filter ↗Filter status is a separate check\t\nskinbaron.com\n10.7 yearsRegistered 2015-12-22\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Market\n\trust.tm\nRegistry date unavailableRegistry date unavailable\nOpen Steam Link Filter ↗Filter status is a separate check\t\ndota2.net\n14.9 yearsRegistered 2011-10-29\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nInstant Swap\n\tpirateswap.com\n6.0 yearsRegistered 2020-09-22\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nlogin.pirateswap.com\n6.0 yearsRegistered 2020-09-22\nRDAP ↗ · pirateswap.com (parent)\nOWN SUBDOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTF2 Marketplace\n\tmannco.store\n8.6 yearsRegistered 2018-03-02\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nmannco.store\n8.6 yearsRegistered 2018-03-02\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nInstant Swap\n\tskinswap.com\n9.9 yearsRegistered 2016-11-14\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.skinswap.com\nRegistry date unavailableRegistry date unavailable\nOWN SUBDOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nP2P Market\n\texeskins.com\n2.1 yearsRegistered 2024-08-14\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nexeskins.com\n2.1 yearsRegistered 2024-08-14\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkins Market\n\tbalticskins.com\n153 daysRegistered 2026-04-21\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nbalticskins.com\n153 daysRegistered 2026-04-21\nRDAP ↗\nSAME HOSTSame hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nInstant Swap\n\tcs.trade\n8.9 yearsRegistered 2017-11-14\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ncs.trade\n8.9 yearsRegistered 2017-11-14\nRDAP ↗\nSAME HOSTSame hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCS2 Market\n\trapidskins.com\n4.5 yearsRegistered 2022-03-11\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.rapidskins.com\n4.5 yearsRegistered 2022-03-11\nRDAP ↗ · rapidskins.com (parent)\nOWN SUBDOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCS2 Market\n\ttradeit.gg\n9.1 yearsRegistered 2017-08-21\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nconnect-tradeit.com\n4.6 yearsRegistered 2022-02-23\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCS2 Market\n\t49skins.com\n3.4 yearsRegistered 2023-04-19\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.49skins.com\n3.4 yearsRegistered 2023-04-19\nRDAP ↗ · 49skins.com (parent)\nOWN SUBDOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCS2 Market\n\tskinvault.gg\n3.4 yearsRegistered 2023-05-06\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.skinvault.gg\n3.4 yearsRegistered 2023-05-06\nIP2WHOIS ↗ · skinvault.gg (parent)\nOWN SUBDOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkins Trading\n\taim.market\n3.3 yearsRegistered 2023-05-22\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\naim.market\n3.3 yearsRegistered 2023-05-22\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nInstant Sell Portal\n\tskinout.gg\n5.6 yearsRegistered 2021-02-27\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nauth.skinout.gg\n5.6 yearsRegistered 2021-02-27\nIP2WHOIS ↗ · skinout.gg (parent)\nOWN SUBDOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkins Trading\n\tntskins.com\n230 daysRegistered 2026-02-03\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nntskins.com\n230 daysRegistered 2026-02-03\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nP2P Portal\n\tgamerpay.gg\n6.0 yearsRegistered 2020-10-02\nWHOISFREAKS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ngamerpay.gg\n6.0 yearsRegistered 2020-10-02\nWHOISFREAKS ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTF2 Scrap Swap\n\tscrap.tf\n14.0 yearsRegistered 2012-09-03\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nscrap.tf\n14.0 yearsRegistered 2012-09-03\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTF2 Cashout\n\tmarketplace.tf\n14.0 yearsRegistered 2012-09-19\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nmarketplace.tf\n14.0 yearsRegistered 2012-09-19\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nInstant Cashout\n\tskins.cash\n10.5 yearsRegistered 2016-03-30\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nskinscash.live\n6.8 yearsRegistered 2019-12-05\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\tcsgo.net\n14.2 yearsRegistered 2012-07-22\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ncn2.easylot.net\n10.0 yearsRegistered 2016-09-03\nRDAP ↗ · easylot.net (parent)\nSEPARATE DOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCommunity Hub\n\tcybershoke.net\n6.8 yearsRegistered 2019-11-18\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nauth.cybershoke.net\nRegistry date unavailableRegistry date unavailable\nOWN SUBDOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nMatchmaker Hub\n\tfastcup.net\n14.6 yearsRegistered 2012-02-16\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.fastcup.net\n14.6 yearsRegistered 2012-02-16\nRDAP ↗ · fastcup.net (parent)\nOWN SUBDOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSaaS Analytics\n\tleetify.com\n7.6 yearsRegistered 2019-03-01\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nleetify.com\n7.6 yearsRegistered 2019-03-01\nRDAP ↗\nSAME HOSTSame hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSaaS Analytics\n\tscope.gg\n7.8 yearsRegistered 2018-12-10\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nscope.gg\n7.8 yearsRegistered 2018-12-10\nIP2WHOIS ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSaaS Tools\n\ttradeupspy.com\n6.5 yearsRegistered 2020-03-11\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.tradeupspy.com\nRegistry date unavailableRegistry date unavailable\nOWN SUBDOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nMarketplace\n\tcs.deals\n9.8 yearsRegistered 2016-12-03\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.cs.deals\n9.8 yearsRegistered 2016-12-03\nRDAP ↗ · cs.deals (parent)\nOWN SUBDOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSaaS Price DB\n\tpricempire.com\n6.6 yearsRegistered 2020-01-30\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\npricempire.com\n6.6 yearsRegistered 2020-01-30\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nMass Blackmarket\n\tFSB Market\n7.2 yearsRegistered 2019-07-27\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nFSB Market\n7.2 yearsRegistered 2019-07-27\nRDAP ↗\nSAME HOSTSame hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nReady-Account Hub\n\tz2u.com\n26.9 yearsRegistered 1999-11-10\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nwww.z2u.com\n26.9 yearsRegistered 1999-11-10\nRDAP ↗ · z2u.com (parent)\nSAME HOSTSame hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Gambling\n\tcsgoroll.com\n11.6 yearsRegistered 2015-02-03\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nwww.csgoroll.com\nRegistry date unavailableRegistry date unavailable\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCrypto Casino\n\trollbit.com\n11.9 yearsRegistered 2014-11-08\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nrbsnin.com\n3 daysRegistered 2026-09-18\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nLicenced Casino\n\t500.casino\n5.9 yearsRegistered 2020-11-08\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRoulette/Slots\n\tcsgobig.com\n11.4 yearsRegistered 2015-04-12\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\tcasedrop.com\n14.8 yearsRegistered 2011-12-16\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Casino\n\tbanditcamp.com\n12.2 yearsRegistered 2014-06-27\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\tskinbox.com\n18.8 yearsRegistered 2007-12-20\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\ttastydrop.com\n6.1 yearsRegistered 2020-08-29\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRoulette Casino\n\tcsgopolygon.gg\n6.5 yearsRegistered 2020-03-28\nWHOISFREAKS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite did not load2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\tmagicdrop.ru\n10.3 yearsRegistered 2016-05-16\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedConsent required2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nDice Casino\n\tcsdice.com\n3.8 yearsRegistered 2022-11-23\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite did not load2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nUpgrader Casino\n\tskinodds.com\n1.2 yearsRegistered 2025-06-26\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Roulette\n\tcsgowin.com\n12.0 yearsRegistered 2014-09-18\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCrash Casino\n\tcsgorun.net\n7.3 yearsRegistered 2019-06-11\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\topenskins.com\n3.6 yearsRegistered 2023-02-26\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Gambling\n\trustbet.com\n7.6 yearsRegistered 2019-02-07\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedConsent required2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Roulette\n\tcsgomagic.com\n9.4 yearsRegistered 2017-05-01\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite did not load2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nUpgrader/Contract\n\tcsgobounty.com\n11.5 yearsRegistered 2015-03-26\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Roulette\n\tezskins.com\n27.5 yearsRegistered 1999-03-11\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\trustcases.com\n7.2 yearsRegistered 2019-06-22\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedConsent required2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Roulette\n\tcsgoreaper.com\n11.1 yearsRegistered 2015-08-21\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tcsgocases.com\n12.3 yearsRegistered 2014-06-08\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Upgrader\n\tcsgo-skins.com\n11.2 yearsRegistered 2015-07-27\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\tcsgonet.com\n8.8 yearsRegistered 2017-12-05\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Roulette\n\twtfskins.com\n9.0 yearsRegistered 2017-10-06\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Casino\n\tflamecases.com\n10.0 yearsRegistered 2016-09-18\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCrypto Casino\n\tgamedom.com\n11.7 yearsRegistered 2015-01-21\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Battles\n\tskin.club\n9.0 yearsRegistered 2017-09-04\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nsc-auth.net\n7.5 yearsRegistered 2019-04-02\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\tdaddyskins.com\n9.9 yearsRegistered 2016-10-19\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedConsent required2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Gambling\n\trustix.gg\n1.7 yearsRegistered 2025-01-16\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Upgrade\n\tskins.club\n4.2 yearsRegistered 2022-07-10\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Roulette\n\tcsgohouse.org\n146 daysRegistered 2026-04-28\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedConsent required2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tskinrave.net\n216 daysRegistered 2026-02-17\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\tbloodycase.gg\n19 daysRegistered 2026-09-02\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nClicker/Upgrade\n\tcsgoclicker.com\n8.3 yearsRegistered 2018-05-17\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Roulette\n\trustbet.gg\n4.0 yearsRegistered 2022-09-30\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\tcs-drop.com\n262 daysRegistered 2026-01-02\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Roulette\n\thellstore.net\n11.7 yearsRegistered 2015-01-11\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Casino\n\trustloot.com\n354 daysRegistered 2025-10-02\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\tcsgo-case.com\n10.3 yearsRegistered 2016-05-16\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tcsgogem.com\n9.9 yearsRegistered 2016-10-16\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCrypto Casino\n\trainbet.com\n8.8 yearsRegistered 2017-11-26\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nservices.rainbet.com\nRegistry date unavailableRegistry date unavailable\nOWN SUBDOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Casino\n\trustclash.com\n5.4 yearsRegistered 2021-05-09\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCrash Casino\n\t12cs.fail\n181 daysRegistered 2026-03-24\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTF2 Gambling\n\twww.tf2easy.com\n6.3 yearsRegistered 2020-06-02\nRDAP ↗ · tf2easy.com (parent)\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTF2 Gambling\n\ttf2blaze.com\n7.6 yearsRegistered 2019-01-28\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCrypto Casino\n\tshuffle.com\n30.1 yearsRegistered 1996-07-31\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCS2 Market\n\tbuff.market\n5.9 yearsRegistered 2020-10-10\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCS2 Market\n\tavan.market\n8.3 yearsRegistered 2018-05-21\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTrading Engine\n\tcs.money\n11.0 yearsRegistered 2015-09-16\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nauth.dota.trade\nRegistry date unavailableRegistry date unavailable\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nP2P Market\n\tuuskins.com\n2.6 yearsRegistered 2024-01-29\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nMass Market\n\tyoupin898.com\n6.1 yearsRegistered 2020-08-27\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCS2 Market\n\tc5game.com\n10.5 yearsRegistered 2016-03-20\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nP2P Marketplace\n\twaxpeer.com\n7.3 yearsRegistered 2019-05-20\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nwaxpeer.com\n7.3 yearsRegistered 2019-05-20\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nBot Trading\n\tcs.money\n11.0 yearsRegistered 2015-09-16\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nauth.dota.trade\nRegistry date unavailableRegistry date unavailable\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nUS Marketplace\n\tdmarket.com\n30.2 yearsRegistered 1996-07-03\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nOfficial Market\n\tsteamcommunity.com/market\n20.3 yearsRegistered 2006-05-28\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNot an external login site2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTrading Platform\n\tlootfarm.com\n11.9 yearsRegistered 2014-10-22\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite did not load2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Market\n\trustskins.com\n7.6 yearsRegistered 2019-01-31\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCS2 Market\n\tkrakatoa.com\n26.4 yearsRegistered 2000-05-15\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nP2P Marketplace\n\tshadowpay.com\n10.1 yearsRegistered 2016-08-06\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nChinese Powerhouse\n\tigxe.cn\n15.0 yearsRegistered 2011-09-06\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nAutomated Swap\n\tswap.gg\n9.6 yearsRegistered 2017-01-29\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCash-out Portal\n\tbitskins.com\n11.2 yearsRegistered 2015-07-21\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTF2 Automation\n\ttf2mart.com\n1.1 yearsRegistered 2025-08-06\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Auctions\n\tskinbid.com\n10.2 yearsRegistered 2016-06-29\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Rental\n\tlootbear.com\n8.7 yearsRegistered 2018-01-16\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTF2 Valuation\n\tbackpack.tf\n14.4 yearsRegistered 2012-05-09\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTF2 Botnet\n\tstntrading.eu\nRegistry date unavailableRegistry date unavailable\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nInstant Cashout\n\tskinwallet.com\n18.0 yearsRegistered 2008-09-14\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nDota 2 Market\n\tdota2market.com\n12.2 yearsRegistered 2014-07-24\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nServer Network\n\txplay.gg\n5.3 yearsRegistered 2021-06-13\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nMatchmaking Portal\n\tesportal.com\n26.8 yearsRegistered 1999-12-20\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nLATAM Hub\n\tgamersclub.com.br\n11.2 yearsRegistered 2015-06-29\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSaaS Tools\n\tepidemic.gg\n4.9 yearsRegistered 2021-11-03\nWHOISFREAKS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSaaS Index\n\tcs2stash.com\n3.5 yearsRegistered 2023-03-05\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite did not load2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSaaS Index\n\tcsgoskins.gg\n6.8 yearsRegistered 2019-12-21\nWHOISFREAKS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSaaS Index\n\tsteamanalyst.com\n12.6 yearsRegistered 2014-02-21\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTrading Exchange\n\tsteamcardexchange.net\n13.3 yearsRegistered 2013-05-22\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSaaS Tracker\n\tdotabuff.com\n14.2 yearsRegistered 2012-06-22\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSaaS Tracker\n\ttracker.gg\n8.9 yearsRegistered 2017-10-12\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nAccount Exchange\n\tfunpay.com\n17.0 yearsRegistered 2009-09-06\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nGrey Market\n\tplayerauctions.com\n26.3 yearsRegistered 2000-06-13\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nAccount Portal\n\teldorado.gg\n8.0 yearsRegistered 2018-09-12\nWHOISFREAKS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nMass Key Market\n\tg2a.com\n24.8 yearsRegistered 2001-12-09\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite did not load2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nMass Key Market\n\tkinguin.net\n16.8 yearsRegistered 2009-12-17\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nVirtual Services\n\tg2g.com\n31.1 yearsRegistered 1995-08-10\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nAccount Broker\n\tplayerup.com\n19.3 yearsRegistered 2007-05-30\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSmurf Shop\n\tsmurfhub.net\n2.7 yearsRegistered 2023-12-26\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite did not load2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSmurf Shop\n\tsmurfaccounts.com\n5.3 yearsRegistered 2021-05-18\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRank Shop\n\tbuycsgorank.com\n6.2 yearsRegistered 2020-07-09\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSmurf Shop\n\tcsgosmurfkings.com\n9.3 yearsRegistered 2017-06-08\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite did not load2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSmurf Shop\n\tsmurfstore.co\n8.6 yearsRegistered 2018-03-03\nWHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCard Leveling\n\tsteamlvlup.com\n9.9 yearsRegistered 2016-11-10\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCard Leveling\n\tsteamlevels.com\n10.6 yearsRegistered 2016-02-19\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCard Leveling\n\tlevelsteam.com\n79 daysRegistered 2026-07-04\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCard Leveling\n\tsteamlevelu.com\n6.0 yearsRegistered 2020-09-05\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRank Boosting\n\teloking.com\n12.2 yearsRegistered 2014-07-02\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRank Boosting\n\tboosteria.org\n11.9 yearsRegistered 2014-10-20\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite did not load2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nBoosting SaaS\n\tovergear.com\n14.4 yearsRegistered 2012-04-20\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nBoosting SaaS\n\tblazingboost.com\n14.2 yearsRegistered 2012-06-23\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRank Boosting\n\tdota2boost.com\n2.9 yearsRegistered 2023-10-11\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite did not load2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nBoosting SaaS\n\tbuyboost.com\n22.4 yearsRegistered 2004-04-30\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\nThe investigation’s argumentSelected rule / analysis & commentary+\nBurden of proof\n\nThe investigation challenges the gap between restrictions on commercial use and the services recorded here. Classify each activity and establish any express permission before calling it a contractual violation. Community Market fees do not apply to every external trade.\n\nWhat a tagged record is, and is not\n\nA record is tagged when the dossier holds a dated observation that brings the platform within the clause on its face. A tag is not an adjudicated violation, and no express Valve permission has been produced on the record for any platform listed here. Where a platform holds an authorisation, publishing it resolves the entry.\n\nSources & methodologyEstimates, definitions & scope+\n\nCounts above refer to the selected rule. Record types group each platform once; full tags appear in the platform details. Search and filters apply within that rule. Registration dates come from the saved RDAP / WHOIS snapshot. Subdomains use the parent domain’s creation date. Age alone does not establish continuous operation or an authentication route. Current auth hostnames come from saved OpenID requests, with a UTC timestamp; unresolved checks do not reuse legacy labels. The observer stops before Steam login and does not test Steam Link Filter status. Download route observations ↗ Download registry results ↗\n\nExplore the source archive ↗\nAppendix G — From a template refusal to the underlying record\nDSAR playbook: request the evidence\n\nUse Article 15 GDPR to request personal data relating to API-key creation, account recovery and support access. A retained record can test who initiated an action and what the platform relied on.\n\n01\nPreserve your timeline.\n\nSave account notices, tickets, trade IDs and dates in UTC. Secure the account and review the recovery options applicable to the game and transaction.\n\nSteam Trade Protection information ↗\n02\nRequest your retained data.\n\nAsk for timestamps, source IPs, key lifecycle events, security confirmations and account-related recovery actions. Include support-access events and recipients where those data concern you.\n\n03\nKeep the delivery record.\n\nUse Valve's privacy contact route. The usual response period is one month; a necessary extension of up to two further months must be explained within that first month.\n\nValve privacy contact route ↗ archived 2026-09-21 ↗\n04\nCompare the response.\n\nReconcile logs with your timeline. Ask for reasons for omissions, then use the supervisory-authority complaint route if necessary. Preserve the response exactly as received.\n\nScope / Article 15\n\nAccess covers retained personal data, including data in logs. It does not guarantee every internal document, reconstructed records or unredacted data about others. Ask for an intelligible copy and the basis for any restriction.\n\nEDPB access guidelines, §§ 2, 4–6 ↗ · GDPR Articles 12, 15, 77 ↗ archived 2026-09-20 ↗\n\nData subject access requestGDPR / Article 15\nAccount security & access records\n\nReplace the bracketed fields before submitting.\n\nTo: Valve Privacy Team\nSubject: Article 15 GDPR request — account security records\n\nAccount / SteamID: [YOUR ACCOUNT IDENTIFIER]\nRelevant period (UTC): [START] to [END]\nRelated support tickets: [TICKET REFERENCES]\n\nI request a copy of the personal data concerning me that you retain for this period, including:\n\n1. API-key registration, confirmation, use and revocation events, with available timestamps, source IP addresses, registered domains, device or user-agent information and non-secret key identifiers.\n\n2. Recorded account-recovery actions, password/email/phone changes, Steam Guard removals or resets, confirmation events and the account-related evidence relied on to authorize those actions.\n\n3. Personal data in support-access and administrative-action logs concerning my account, including available dates, purposes, actions and the support entity involved, subject to applicable rights of others.\n\n4. Account-related records used to determine any sanction, and available records of my complaints, reviews and responses.\n\nPlease also provide the applicable processing purposes, categories, recipients, retention periods or criteria, and available information about sources where data were not obtained from me.\n\nWhere processing relies on my consent, please provide the retained record of the consent relied upon and the wording presented at that time.\n\nPlease provide an intelligible electronic copy with time zones and field definitions. Please do not include active credentials or secret tokens. If any requested data are not held, please say so. For any withheld data, please identify the scope and legal basis of the restriction and provide the remainder.\n\nPlease acknowledge receipt and respond within the applicable Article 12 period, explaining any necessary extension. I also ask you to preserve relevant existing records while this request is handled.\n\nName: [YOUR NAME]\nDate: [DATE]\nWhat a data-centre IP can establish\nA discrepancy is evidence to investigate.\n\nAn API-key request originating from a data-centre network, as in the hosting-provider example raised in this investigation, can be relevant when compared with login records, confirmations and the user's timeline. An IP alone does not identify the actor or automatically defeat every defence. Evidence that a hostile actor supplied the recorded consent could challenge reliance on that consent; other legal bases and liability issues require separate analysis.\n\nSee the preserved ban-and-GDPR complaint →\nAppendix H — Wayback Machine archive analysis · published support statistics\nSupport volume. Published response times.\nContext & source limits\n\nValve publishes daily support statistics at store.steampowered.com/stats/support. Wayback Machine archives preserve historical snapshots of this page from 2018 to 2026. The volume-to-headcount ratio implied by these figures is inconsistent with per-ticket human review at the published response times.\n\nCompare Valve's archived support figures across the saved snapshots. The methodology explains what those figures can and cannot measure.\n\nVolume against published response time (2018 → 2026)\nTwo queues at one support desk, read across 21 archived captures.\n\nValve publishes live support figures at store.steampowered.com/stats/support. Each point below is the lower bound Valve itself printed on that page on the day the Internet Archive captured it — not an estimate of ours. Both series are the same measure in the same unit, so they belong on one axis and can be read against each other directly.\n\nRefund requests — money Valve is holdingAccount security & recovery — the account you have lost\n0 h\n2 h\n4 h\n6 h\n8 h\n10 h\nno captures · 38 months\n2019\n2020\n2021\n2022\n2023\n2024\n2025\n2026\n8 h 44 m\naccount recovery\n52 m\nrefunds\n15 m — one capture only\n49–55 minThe refund lower bound in every capture from February 2018 to August 2026. Across eight and a half years it moves by under six minutes, while daily refund volume moves by a factor of nine.\n2.4 h → 8.7 hThe account-recovery lower bound sits near 2.4 hours in every capture through December 2022 but one. In the three 2026 captures Valve publishes 10.9 h, 5.8 h and 8.7 h.\n×2.8 → ×13How much slower recovery is than refunds, by Valve's own published figures. Steady for five years, then it widens — the queue that got slower is the one where the user, not Valve, is out of pocket.\n\nSource: 21 Wayback Machine captures of store.steampowered.com/stats/support, 2018-02-03 to 2026-08-10; extraction in VALVE_EVIDENCE_PACK/databases/steam_support_stats_history.json. Read the limits with the figures: the chart plots the lower bound of the range Valve prints. The published upper bound is worse on both lines — refunds ranged 1.5 hours to 1.5 days, recovery 7.0 hours to 3.6 days. Two captures were archived in a localised edition of the same Valve page — 2018-11-03 in Czech, 2020-03-25 in French — and are marked (cs) and (fr) in the table; their figures appear here with the unit words translated and the numbers as published, and the verbatim source strings are kept in the extraction file. Every capture published a response time for both queues, and no point on either line is interpolated. The single 15-minute recovery figure of 2020-10-21 is flagged on the chart and left in: it appears in one capture only and no other capture is within an order of magnitude of it. No capture exists between 2022-12-08 and 2026-02-01; that 38-month hole in the record is shaded, and nothing is drawn across it. These figures describe published response times. They do not show what happens inside a ticket, and Valve has published no headcount against which to read them.\n\nOpen every capture as a table\nEvery archived capture, as published\nCapture\tRefunds / day\tRefund response\tRecovery / day\tRecovery response\n2018-02-03\t98,788\t50.12 minutes to 1.52 hours\t25,662\t2.51 hours to 1.80 days\n2018-05-07\t60,494\t53.83 minutes to 1.47 days\t24,226\t2.45 hours to 2.22 days\n2018-08-02\t69,084\t50.27 minutes to 1.59 hours\t28,953\t2.44 hours to 22.17 hours\n2018-11-03 (cs)\t63,410\t49.28 minutes to 1.54 hours\t33,910\t2.42 hours to 1.31 days\n2019-02-01\t76,305\t50.13 minutes to 1.52 hours\t35,164\t2.44 hours to 2.04 days\n2019-05-18\t78,951\t51.03 minutes to 3.12 hours\t27,514\t2.46 hours to 20.39 hours\n2019-09-07\t78,941\t50.65 minutes to 1.66 hours\t28,812\t2.42 hours to 13.59 hours\n2019-12-13\t69,589\t50.77 minutes to 1.55 hours\t25,322\t2.45 hours to 1.13 days\n2020-03-25 (fr)\t139,278\t49.45 minutes to 1.53 hours\t32,302\t2.48 hours to 3.62 days\n2020-06-26\t278,504\t48.98 minutes to 2.29 hours\t20,343\t2.39 hours to 6.99 hours\n2020-10-21\t107,633\t50.80 minutes to 1.54 hours\t20,688\t15.33 minutes to 8.62 hours\n2021-03-20\t158,956\t50.80 minutes to 1.64 hours\t25,760\t2.34 hours to 11.62 hours\n2021-06-26\t547,907\t51.93 minutes to 6.73 hours\t29,728\t2.40 hours to 15.63 hours\n2021-10-10\t170,103\t51.88 minutes to 3.25 hours\t23,989\t2.39 hours to 13.05 hours\n2022-01-31\t354,386\t53.65 minutes to 8.09 hours\t24,391\t2.42 hours to 15.29 hours\n2022-05-09\t172,555\t51.83 minutes to 1.65 hours\t23,289\t2.41 hours to 16.90 hours\n2022-09-05\t153,453\t53.67 minutes to 4.15 hours\t23,594\t2.45 hours to 1.22 days\n2022-12-08\t181,075\t54.83 minutes to 6.67 hours\t27,111\t2.46 hours to 18.89 hours\n2026-02-01\t317,762\t50.30 minutes to 1.52 hours\t47,197\t10.91 hours to 21.30 hours\n2026-05-09\t246,776\t50.12 minutes to 1.52 hours\t35,264\t5.81 hours to 15.60 hours\n2026-08-10\t373,244\t52.05 minutes to 2.07 hours\t45,319\t8.73 hours to 16.52 hours\nKEY OBSERVATION:\nAcross 21 Wayback captures spanning 2018-02-03 to 2026-08-10, daily refund submissions ranged from 60,494 (May 2018) to 547,907 (June 2021) — a 9.1× spread. The 2026 figure is 373,244 (+278% vs the February 2018 capture).\nOver those same nine years the published lower bound for refund response time never left a 49–55 minute band: a total movement of under six minutes while the workload behind it moved by a factor of nine.\nIf a person read each ticket for even 5 seconds, processing 373,244 tickets per day (current) would occupy 22 agents working 24/7 just to open and close them; at peak (547,907, June 2021) that rises to 32.\nIf the published response time reflected per-ticket handling time (~52 min/ticket), the implied concurrent staffing would be on the order of 13,500 agents at current volume and ~20,000 at peak. No sourced figure for Valve's support headcount has been located; none is assumed here.\nWhat follows: the volume-to-headcount ratio is inconsistent with per-ticket human review at the published response times. The figures are consistent with a largely automated first pass; what proportion receives human review is not published.\nWhy this matters for GDPR compliance\n\nGDPR Article 22 prohibits solely automated individual decision-making that produces significant legal effects, without providing the right to human review on request. If Steam Support decisions (ticket closures, account actions, refusal of data requests) are made entirely by automated scripts, every such decision that \"significantly affects\" the user may violate Article 22.\n\nTicket HT-2YBP-F7JP-D4VB (Section 18) was closed after three days with a template referral and no engagement with the legal basis cited. Whether a person reviewed it cannot be determined from the ticket; that is a question the supervisory authority can put to Valve under Article 22 and Article 15(1)(h).\n\nSource: Wayback Machine snapshots of store.steampowered.com/stats/support (2018-02-03, 2021-06-26, 2026-08-10) — data extracted into VALVE_EVIDENCE_PACK/databases/steam_support_stats_history.json (21 snapshots, 2018–2026). Note: the \"~52 min\" response time is the refund-category lower bound; account security response was 2.4–16.5 hrs across the same snapshots. 2021-06-26 is the all-time peak (547,907 refund requests), not a monotone midpoint — volume surged ~6× in 2020–2021 then partially fell before recovering to 373K in 2026.\nAppendix I — Dataset scope · counts that can be reproduced\nCount the records. Check the scope.\nContext & source limits\n\nCount the records, then test the claims: every figure below is re-derivable from the published files.\n\nInspect the underlying datasets, reproduce the counts, and distinguish source rows from unique incidents.\n\nThe master CSV contains 40,448 rows. Of these, 36,516 come from the Discord-AntiScam phishing feed. The remaining 3,932 rows span GitHub, reviews, search results, forum material and other sources, providing a comprehensive index of reported community topics and security reports.\n\nWithin that CSV, 1,690 rows are categorised under the \"Unpatched Security Exploit\" collection label, representing historical user issues and vulnerability disclosures. Tracing these reports involves reviewing each thread's specific build timeline and public patch history.\n\nThe 16,319-record searchable archive is a separate, curated build with its own manifest, designed for precise local exploration of specific user claims and incident reports.\n\nTo build a reliable audit trail, every user-reported record must be verified against documented build timelines and historical patch logs.\n\nThe separate Part II collection records 231,829 unique listing IDs, including 33,509 in the automated registration category and 198,320 flagged as unverified transfers. The input file's SHA-256 matches the preserved measurement. These counts describe listing attempts and observed transfers rather than finalized transaction values or verified theft totals, highlighting the need for primary platform records to measure the exact economic impact. Listing measurements and hashes ↗\n\nMaster CSV ↗ · Searchable archive manifest ↗ · Inspect source records ↗\n\nAppendix J — About this investigation\nValve publishes no enforcement record. We built one.\n\nIndependent. Non-commercial. Built from public data only. Submitted to regulators.\n\n88.97%automation fleet untouched — no ban of any kind\n67.77%of 51,732 adjudicated scammers walk free\n$26.8M+floor on store spend by non-limited fleet\n3.6%gambling domains blocked by Valve's Link Filter\n8 yearsof security incidents documented\n\nWhat this is. A forensic dossier into Valve Corporation's Steam platform — its enforcement record, its card-farming economy, its legal framework, and the authentication infrastructure that gambling operators use through Steam's own OpenID relay. Every figure is reproducible from two sources: Valve's own public API and the datasets published alongside this investigation.\n\nWho it is for. Regulators with jurisdiction over Valve — the GDPR supervisory authority for the Netherlands, FinCEN, the SEC, the DSA Digital Services Coordinator, UOKiK, and any law enforcement agency examining Steam-linked financial flows. Also for journalists, researchers, and every user who received a permanent account ban, a refused refund, or a stolen inventory and was told there is no appeal.\n\nThe single demand. Valve holds this data at full fidelity — ban reasons attached, full ID space, real-time. It can run every query in this dossier in seconds and has chosen not to publish any of it. The question for any competent authority is simple: why not?\n\nWhat the authors do not claim. No login to Steam was completed on any third-party platform during this work. A supplied OpenID URL establishes the request parameters, not a completed login. A separate registrable domain is not by itself proof of evasion. Registration dates are lower bounds on when a host could first have appeared in an OpenID request; they do not establish continuous use. The authors do not assert what Valve knew or intended: every statement about Valve is tied to a dated public document or a dated observation. Where a claim could not be put behind a source document, it has been removed.\n\nWho we are\n\nPhishDestroy — independent investigators. No affiliation with Valve Corporation or any platform named here. One Steam account was used solely to document the GDPR request in Section 18.\n\nLegal disclaimer\n\nNon-commercial, decentralized public-interest investigation. All data provided \"as is\" with zero warranties. This publication is not a judicial finding.\n\nPUBLIC DOMAIN\nLicensing\n\nAll rights surrendered to humanity. Reproduce, adapt, publish — attribution not required. OFAC-region access: prohibited. Full licence & disclaimer →",
    "headings": [
      {
        "level": 2,
        "id": "briefing-heading",
        "text": "The rule. The record. The unanswered questions."
      },
      {
        "level": 2,
        "id": null,
        "text": "Open letter to the Washington State Gambling Commission"
      },
      {
        "level": 3,
        "id": "wsgc-public-address-title",
        "text": "Ten days became ten years.Reopen the record."
      },
      {
        "level": 2,
        "id": null,
        "text": "The site is blocked. The login route is not."
      },
      {
        "level": 3,
        "id": null,
        "text": "Figure 3.1 — The two routes, drawn."
      },
      {
        "level": 3,
        "id": null,
        "text": "The Big Picture Trap: Link Filter is Compliance Theater, Not a Shield"
      },
      {
        "level": 3,
        "id": null,
        "text": "A blocked main domain paired with an unblocked auth host leaves the login route open — and it stays open for years."
      },
      {
        "level": 3,
        "id": null,
        "text": "Background: What Steam Is and Why It Matters Here"
      },
      {
        "level": 3,
        "id": null,
        "text": "What Valve Did: The Domain Block"
      },
      {
        "level": 3,
        "id": null,
        "text": "What a Proxy Domain Is"
      },
      {
        "level": 3,
        "id": null,
        "text": "The Critical Point: The Auth Host Is Sent to Steam in Every Request"
      },
      {
        "level": 3,
        "id": null,
        "text": "What This Proves"
      },
      {
        "level": 3,
        "id": null,
        "text": "Inside Steam, Valve's list is the only list."
      },
      {
        "level": 3,
        "id": null,
        "text": "Link filter protection bypass"
      },
      {
        "level": 3,
        "id": null,
        "text": "Big Picture web browser leaks login cookies and discloses sensitive information (may lead to account takeover)"
      },
      {
        "level": 3,
        "id": null,
        "text": "What this means for a minor with an antivirus installed"
      },
      {
        "level": 3,
        "id": null,
        "text": "The domain’s age.The observation’s date."
      },
      {
        "level": 2,
        "id": null,
        "text": "An endpoint closed. Public tracing lost a key."
      },
      {
        "level": 3,
        "id": null,
        "text": "The Pre-Blackout Era"
      },
      {
        "level": 3,
        "id": null,
        "text": "After the change"
      },
      {
        "level": 2,
        "id": null,
        "text": "One session. More access than the user sees."
      },
      {
        "level": 3,
        "id": null,
        "text": "1. Insufficient Step-up Authentication"
      },
      {
        "level": 3,
        "id": null,
        "text": "2. Lack of Principle of Least Privilege"
      },
      {
        "level": 3,
        "id": null,
        "text": "3. Broken Session Management"
      },
      {
        "level": 3,
        "id": null,
        "text": "4. Domain-Level Blocking of Auth Hosts Was Technically Feasible"
      },
      {
        "level": 3,
        "id": "integration-paradox-title",
        "text": "Valve builds against these rules every day. It did not build to them here."
      },
      {
        "level": 4,
        "id": null,
        "text": "GitHub Fine-Grained Scopes vs Valve Steam Web API"
      },
      {
        "level": 2,
        "id": null,
        "text": "Interactive Exploit & Hijack Simulator"
      },
      {
        "level": 2,
        "id": null,
        "text": "The endpoints behind the sequence."
      },
      {
        "level": 2,
        "id": null,
        "text": "A checked box. Whose action?"
      },
      {
        "level": 3,
        "id": null,
        "text": "How Valve Finally Neutralized \"Trade Substitution\" — And Why It Took 7 Years of Workarounds"
      },
      {
        "level": 4,
        "id": null,
        "text": "Avatar & Name Cooldown (Feb 2024)"
      },
      {
        "level": 4,
        "id": null,
        "text": "7-Day CS2 Trade Reversal (Jul 2025)"
      },
      {
        "level": 4,
        "id": null,
        "text": "Mandatory Mobile Push for API (Dec 2023)"
      },
      {
        "level": 4,
        "id": null,
        "text": "Account Age & Name Banners (2022–2024)"
      },
      {
        "level": 2,
        "id": null,
        "text": "Their rulebook. The recorded platforms."
      },
      {
        "level": 3,
        "id": "enforcement-focus-title",
        "text": "One rulebook. Unequal enforcement."
      },
      {
        "level": 4,
        "id": null,
        "text": "Automation"
      },
      {
        "level": 4,
        "id": null,
        "text": "Commercial use"
      },
      {
        "level": 4,
        "id": null,
        "text": "VPN & location disguise"
      },
      {
        "level": 4,
        "id": null,
        "text": "Link obfuscation"
      },
      {
        "level": 4,
        "id": null,
        "text": "Who reviews the decision when support closes the case?"
      },
      {
        "level": 2,
        "id": null,
        "text": "An automation API. A rule against automation."
      },
      {
        "level": 3,
        "id": null,
        "text": "The \"Game Developer\" Fallacy"
      },
      {
        "level": 4,
        "id": null,
        "text": "The Automation Contradiction"
      },
      {
        "level": 4,
        "id": null,
        "text": "A server-side position in the trade flow"
      },
      {
        "level": 2,
        "id": null,
        "text": "Ten days demanded. Ten years to account for."
      },
      {
        "level": 3,
        "id": "letter-company",
        "text": "VALVE CORPORATION"
      },
      {
        "level": 3,
        "id": null,
        "text": "Ten days.Then what?"
      },
      {
        "level": 3,
        "id": null,
        "text": "Follow the declared return host."
      },
      {
        "level": 3,
        "id": "washington-record-heading",
        "text": "Two deadlines. One unanswered enforcement standard."
      },
      {
        "level": 4,
        "id": null,
        "text": "Valve gives gambling sites 10 days"
      },
      {
        "level": 4,
        "id": null,
        "text": "Washington presses Valve"
      },
      {
        "level": 4,
        "id": null,
        "text": "Valve rejects the charge"
      },
      {
        "level": 4,
        "id": null,
        "text": "The routes observed in September 2026"
      },
      {
        "level": 4,
        "id": null,
        "text": "Eighteen months after Valve replied, the regulator still called it an intent."
      },
      {
        "level": 3,
        "id": null,
        "text": "The 10-Day Notice Decade: Forensic Survival Audit of the 23 Named Sites"
      },
      {
        "level": 4,
        "id": null,
        "text": "From 10-Day Warnings to Offshore Conglomerates: The Multi-Billion-Dollar Turnover"
      },
      {
        "level": 2,
        "id": null,
        "text": "The hostname is already in the request."
      },
      {
        "level": 3,
        "id": null,
        "text": "Documented and reported precedents"
      },
      {
        "level": 3,
        "id": null,
        "text": "What a registration date does and does not show"
      },
      {
        "level": 3,
        "id": null,
        "text": "Comparative Audit: API Compliance Standards"
      },
      {
        "level": 2,
        "id": "market-thesis-heading",
        "text": "The off-Steam price gap"
      },
      {
        "level": 2,
        "id": null,
        "text": "The price gap is measurable."
      },
      {
        "level": 3,
        "id": null,
        "text": "What the dollar figure shows"
      },
      {
        "level": 3,
        "id": null,
        "text": "Many venues list more dollar value than Steam."
      },
      {
        "level": 3,
        "id": null,
        "text": "Steam still leads in number of offers."
      },
      {
        "level": 3,
        "id": null,
        "text": "The commercial ecosystem is in plain sight."
      },
      {
        "level": 2,
        "id": null,
        "text": "Who can reset the safeguards?"
      },
      {
        "level": 3,
        "id": null,
        "text": "A recovery ticket that disabled the account's security, and a reported $10,000 loss"
      },
      {
        "level": 3,
        "id": null,
        "text": "Beyond the inventory."
      },
      {
        "level": 3,
        "id": "theft-ledger-title",
        "text": "Valve admitted the door twice, thirty-three months apart. It never closed."
      },
      {
        "level": 4,
        "id": null,
        "text": "What the ledger says that no single case does."
      },
      {
        "level": 3,
        "id": null,
        "text": "Confidentiality must come with technical accountability."
      },
      {
        "level": 2,
        "id": null,
        "text": "Follow the money. Separate the transactions."
      },
      {
        "level": 3,
        "id": null,
        "text": "Where the money actually moves."
      },
      {
        "level": 3,
        "id": null,
        "text": "Classify the activity, then the obligation."
      },
      {
        "level": 3,
        "id": null,
        "text": "Trace proceeds, knowledge and assistance."
      },
      {
        "level": 2,
        "id": null,
        "text": "The Digital Services Act: put knowledge on the record"
      },
      {
        "level": 3,
        "id": null,
        "text": "A ten-day demand."
      },
      {
        "level": 3,
        "id": null,
        "text": "The DSA time window."
      },
      {
        "level": 3,
        "id": null,
        "text": "Duration needs a notice trail."
      },
      {
        "level": 3,
        "id": null,
        "text": "of annual worldwide turnover"
      },
      {
        "level": 2,
        "id": null,
        "text": "Minors: a Steam login is not an age check"
      },
      {
        "level": 3,
        "id": null,
        "text": "Identify the operator and the data."
      },
      {
        "level": 3,
        "id": null,
        "text": "Record the journey from login to deposit."
      },
      {
        "level": 2,
        "id": null,
        "text": "The request. The reply. The missing comparison."
      },
      {
        "level": 3,
        "id": null,
        "text": "The records exist; the data subject did not receive them."
      },
      {
        "level": 2,
        "id": null,
        "text": "The Subscriber Agreement against the platform's own architecture"
      },
      {
        "level": 3,
        "id": null,
        "text": "The Market ceiling and the commercial-use prohibition"
      },
      {
        "level": 3,
        "id": null,
        "text": "The API-key vulnerability as a platform design question rather than user negligence"
      },
      {
        "level": 3,
        "id": null,
        "text": "Valve receives the auth hostname on every login"
      },
      {
        "level": 3,
        "id": null,
        "text": "The pattern in the archived complaints"
      },
      {
        "level": 3,
        "id": null,
        "text": "A court evaluating this record would not read the SSA in isolation."
      },
      {
        "level": 2,
        "id": null,
        "text": "The findings. The records we ask for."
      },
      {
        "level": 2,
        "id": null,
        "text": "Evidence Memorandum — material provided by Source 1"
      },
      {
        "level": 2,
        "id": null,
        "text": "The redaction in the produced PDF is cosmetic: the covered text remains extractable"
      },
      {
        "level": 2,
        "id": null,
        "text": "Support and Legal Correspondence Exhibits"
      },
      {
        "level": 2,
        "id": null,
        "text": "Selected primary records"
      },
      {
        "level": 3,
        "id": "receipt-heading-gh-01",
        "text": "Hardware keys, requested in 2016"
      },
      {
        "level": 3,
        "id": "receipt-heading-gh-02",
        "text": "Crash reports without an effective opt-out"
      },
      {
        "level": 3,
        "id": "receipt-heading-gh-03",
        "text": "Auth-ticket abuse reported to Valve"
      },
      {
        "level": 3,
        "id": "receipt-heading-rd-01",
        "text": "44 disputed Market purchases"
      },
      {
        "level": 3,
        "id": "receipt-heading-rd-02",
        "text": "A permanent ban and closed appeals"
      },
      {
        "level": 3,
        "id": "receipt-heading-rd-03",
        "text": "A recovery reset and a reported $10,000 loss"
      },
      {
        "level": 2,
        "id": null,
        "text": "ArchiSteamFarm and the automation clause"
      },
      {
        "level": 2,
        "id": null,
        "text": "Rules ledger: clauses against recorded platforms"
      },
      {
        "level": 3,
        "id": "ledger-title",
        "text": "Commercial Use & Account Charging"
      },
      {
        "level": 3,
        "id": "lw-register-title",
        "text": "Platform register 175"
      },
      {
        "level": 4,
        "id": null,
        "text": "Burden of proof"
      },
      {
        "level": 4,
        "id": null,
        "text": "What a tagged record is, and is not"
      },
      {
        "level": 2,
        "id": null,
        "text": "DSAR playbook: request the evidence"
      },
      {
        "level": 3,
        "id": null,
        "text": "Preserve your timeline."
      },
      {
        "level": 3,
        "id": null,
        "text": "Request your retained data."
      },
      {
        "level": 3,
        "id": null,
        "text": "Keep the delivery record."
      },
      {
        "level": 3,
        "id": null,
        "text": "Compare the response."
      },
      {
        "level": 3,
        "id": null,
        "text": "Account security & access records"
      },
      {
        "level": 3,
        "id": null,
        "text": "A discrepancy is evidence to investigate."
      },
      {
        "level": 2,
        "id": null,
        "text": "Support volume. Published response times."
      },
      {
        "level": 3,
        "id": null,
        "text": "Two queues at one support desk, read across 21 archived captures."
      },
      {
        "level": 2,
        "id": null,
        "text": "Count the records. Check the scope."
      },
      {
        "level": 2,
        "id": null,
        "text": "Valve publishes no enforcement record.\nWe built one."
      }
    ],
    "links": [
      "https://phishdestroy.io/steam_dossier/de/",
      "https://dotesports.com/counter-strike/news/csgo-lounge-billion-bets-3896",
      "https://store.steampowered.com/agreement/?l=english",
      "https://web.archive.org/web/20260921022032/https://store.steampowered.com/agreement/?l=english",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-all-results.json",
      "https://blog.counter-strike.net/expresstrade/",
      "https://web.archive.org/web/20260307161538/https://blog.counter-strike.net/expresstrade/",
      "https://wsgc.wa.gov/news/2016/washington-state-gambling-commission-orders-valve-stop-skins-gambling",
      "https://web.archive.org/web/20260520012601/https://wsgc.wa.gov/news/2016/washington-state-gambling-commission-orders-valve-stop-skins-gambling",
      "https://fr.scribd.com/document/328063293/Valve-s-Oct-18th-response-to-Washington-State-Gambling-Commission-s-cease-and-desist",
      "https://store.steampowered.com/oldnews/22883",
      "https://web.archive.org/web/20260921021947/https://store.steampowered.com/oldnews/22883",
      "https://web.archive.org/web/20260921022628/https://steamcommunity.com/linkfilter/?url=https:%2F%2Frollbit.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/rbsnin.com.20260921T021120Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rollbit.com.json",
      "https://web.archive.org/web/20260921022740/https://steamcommunity.com/linkfilter/?url=https:%2F%2Fskin.club",
      "https://web.archive.org/web/20260921022842/https://steamcommunity.com/linkfilter/?url=https:%2F%2Fsc-auth.net",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skin.club.json",
      "https://web.archive.org/web/20260921022603/https://steamcommunity.com/linkfilter/?url=https:%2F%2Fhowl.gg",
      "https://web.archive.org/web/20260921022636/https://steamcommunity.com/linkfilter/?url=https:%2F%2Fhowl.uno",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/howl.gg.json",
      "https://web.archive.org/web/20260921022840/https://steamcommunity.com/linkfilter/?url=https:%2F%2Fduelbits.com",
      "https://web.archive.org/web/20260921022901/https://steamcommunity.com/linkfilter/?url=https:%2F%2Fswitchflips.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/duelbits.com.json",
      "https://web.archive.org/web/20260921022758/https://steamcommunity.com/linkfilter/?url=https:%2F%2Fcsgofast.com",
      "https://web.archive.org/web/20260921022847/https://steamcommunity.com/linkfilter/?url=https:%2F%2Fauthtofast.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgofast.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/farmskins.com.20260921T025840Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/steam.kobal.cc.20260921T025844Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/farmskins.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/cobaltlab.tech.20260921T041604Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/cobaltauth.com.20260921T041608Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/cobaltlab.tech.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/csgo.net.20260921T041619Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/cn2.easylot.net.20260921T041623Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgo.net.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/ggdrop.com.20260921T041637Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/ggauth.com.20260921T041641Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/ggdrop.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/rustchance.com.20260921T041703Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/hgfuihd.com.20260921T041706Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustchance.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/skin.fans.20260921T041710Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/auth.skinfans.com.20260921T041713Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skin.fans.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/skinport.com.20260921T041724Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/skinport.app.20260921T041728Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinport.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/skins.cash.20260921T041731Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/skinscash.live.20260921T041735Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skins.cash.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/tf2hunt.com.20260921T041739Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/rstspcl.com.20260921T041742Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tf2hunt.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/csgogem.com.20260922T192355Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/api.csgem.com.20260922T192358Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-2026-09-22.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/gamdom.com.20260922T192326Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/login.gambldom.com.20260922T192330Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/12cs.fail.20260922T192347Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/fail.games.20260922T192351Z.html",
      "https://web.archive.org/web/20260921022953/https://steamcommunity.com/linkfilter/?url=https:%2F%2Fcsgoempire.com",
      "https://web.archive.org/web/20260921022947/https://steamcommunity.com/linkfilter/?url=https:%2F%2Fcsgoempirelogin4.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgoempire.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/cs.money.20260921T021131Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/auth.dota.trade.20260921T021134Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/cs.money.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/csfloat.com.20260921T041612Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/csgofloat.com.20260921T041615Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csfloat.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/g4skins.com.20260921T041630Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/auth.g4s.to.20260921T041634Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/g4skins.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/juice.gg.20260921T041644Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/letmeinjuice.com.20260921T041648Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/juice.gg.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/market.csgo.com.20260921T041652Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/dota2.net.20260921T041655Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/market.csgo.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/rust.tm.20260921T041659Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rust.tm.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/csgolounge.com.20260922T192333Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/dota2.net.20260922T192340Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/dota2lounge.com.20260922T192337Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/skinbaron.de.20260921T041717Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/skinbaron.com.20260921T041721Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinbaron.de.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/tf2royal.com.20260921T041746Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/tf2auth.com.20260921T041750Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tf2royal.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/tradeit.gg.20260921T041753Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/connect-tradeit.com.20260921T041757Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tradeit.gg.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/upgrader.pro.20260921T041801Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/upgauth.space.20260921T041804Z.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/upgrader.pro.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-recheck-2026-09-21.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registration.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/wayback-snapshots.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-2026-09-22c.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/master_registry.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/longitudinal-steam-phishing-audit.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-steam-phishing-100.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-coverage-2026-09-22.json",
      "https://blog.csfloat.com/how-floatdb-tracks-items/",
      "https://web.archive.org/web/20260921022415/https://blog.csfloat.com/how-floatdb-tracks-items/",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/platform-audit.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/platforms-removed.json",
      "https://hackerone.com/reports/291750",
      "https://web.archive.org/web/20251116185046/https://hackerone.com/reports/291750",
      "https://hackerone.com/reports/1079561",
      "https://web.archive.org/web/20260924181830/https://hackerone.com/reports/1079561",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/hackerone-reports.json",
      "https://phishdestroy.io/steam_dossier/de/steam_enforcement_evidence.html#support-records",
      "https://www.darknavy.org/blog/exploiting_steam_usual_and_unusual_ways_in_the_cef_framework/",
      "https://steamcommunity.com/groups/SteamClientBeta/discussions/0/3365901765276206401/",
      "https://web.archive.org/web/20250804051514/https://steamcommunity.com/groups/SteamClientBeta/discussions/0/3365901765276206401/",
      "https://www.chromium.org/developers/design-documents/safebrowsing/",
      "https://web.archive.org/web/20260821101616/https://www.chromium.org/developers/design-documents/safebrowsing/",
      "https://www.chromium.org/developers/how-tos/api-keys/",
      "https://web.archive.org/web/20260830122831/https://www.chromium.org/developers/how-tos/api-keys/",
      "https://github.com/Homebrew/homebrew-cask/issues/193814",
      "https://testsafebrowsing.appspot.com/",
      "https://datatracker.ietf.org/doc/rfc6749/",
      "https://docs.cloud.google.com/docs/authentication/api-keys",
      "https://listings.pcisecuritystandards.org/pdfs/PCI_DSS_Resource_Guide_(003).pdf",
      "https://developer.apple.com/news/?id=02202019a",
      "https://web.archive.org/web/20250506070026/https://developer.apple.com/news/?id=02202019a",
      "https://dev.twitch.tv/docs/authentication/validate-tokens/",
      "https://discuss.dev.twitch.com/t/legacy-twitch-api-v5-i-e-kraken-shutdown-reminder-february-28-2022/36589",
      "https://web.archive.org/web/20250127085635/https://discuss.dev.twitch.com/t/legacy-twitch-api-v5-i-e-kraken-shutdown-reminder-february-28-2022/36589",
      "https://store.steampowered.com/news/posts/?enddate=1788390000",
      "https://steamcommunity.com/groups/steamworks/announcements/detail/4123547285514022851",
      "https://skinvault.gg/blog/cs2-trade-protection-explained/",
      "https://csmarketcap.com/blog/market-insights/from-boom-to-bust-cs2s-trade-protection-impact",
      "https://skin.land/blog/steam-changes-cs2-trade-ban-logic-timing/",
      "https://help.steampowered.com/faqs/view/3041-A87A-E5F6-B6AC",
      "https://steamcommunity.com/ogg/593110/announcements/detail/533224478739530146",
      "https://steamcommunity.com/games/CSGO/announcements/detail/4447966961421256740",
      "https://steamcommunity.com/discussions/forum/1/4202490424033360096/",
      "https://steamcommunity.com/dev/apikey",
      "https://steamcommunity.com/groups/steamworks/announcements/detail/3734103130194459461",
      "https://steamcommunity.com/discussions/forum/1/3807266184852932971/",
      "https://help.steampowered.com/faqs/view/225C-C51E-B8F0-55B2",
      "https://store.steampowered.com/news/group/4/view/3314112260640237775",
      "https://github.com/DoctorMcKay/node-steam-tradeoffer-manager/issues/325",
      "https://blog.dota2.com/2020/05/trading-cooldown/",
      "https://blog.counter-strike.net/index.php/2018/03/20308/",
      "https://web.archive.org/web/20250226114333/https://blog.counter-strike.net/index.php/2018/03/20308/",
      "https://phishdestroy.io/steam_dossier/de/steam_evidence_archive.html",
      "https://steamcommunity.com/groups/steamworks/announcements/detail/493839547938902179",
      "https://store.steampowered.com/online_conduct",
      "https://web.archive.org/web/20260921022120/https://store.steampowered.com/online_conduct",
      "https://store.steampowered.com/subscriber_agreement/",
      "https://web.archive.org/web/20260918014700/https://store.steampowered.com/subscriber_agreement/",
      "https://steamcommunity.com/dev/apiterms",
      "https://web.archive.org/web/20260921022210/https://steamcommunity.com/dev/apiterms",
      "https://help.steampowered.com/en/faqs/view/628C-E332-BD8C-4D36",
      "https://phishdestroy.io/steam_dossier/de/social_graph.html",
      "https://phishdestroy.io/steam_dossier/de/security_timeline.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/wsgc-skins-gambling-briefing-2018.pdf",
      "https://wsgc.wa.gov/sites/default/files/2023-10/Skins%20Gambling.pdf",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/wsgc-briefing-manifest.json",
      "https://x.com/csgobig",
      "https://www.facebook.com/csgobigofficial/",
      "https://500.casino/",
      "https://csgolounge.com/",
      "https://csgocasino.gg/",
      "https://x.com/CSGOatsecom",
      "https://x.com/CSGOSweep/status/937420902538543106",
      "https://x.com/Wild",
      "https://x.com/csgopot",
      "https://x.com/csgodiamondscom",
      "https://search.ftc.gov/legal-library/browse/cases-proceedings/162-3184-csgolotto-trevor-martin-thomas-cassell-matter",
      "https://x.com/CSGODouble",
      "https://x.com/csgo_massive",
      "https://www.facebook.com/csgostrongfree/",
      "https://www.facebook.com/CSNCOM/",
      "https://www.gamblingcommission.gov.uk/news/article/gambling-commission-publishes-new-report-on-children-and-gambling-trends",
      "https://www.gamblingcommission.gov.uk/licensees-and-businesses/guide/page/digital-and-virtual-currencies",
      "https://www.aph.gov.au/Parliamentary_Business/Committees/Senate/Environment_and_Communications/Gamingmicro-transactions/Report",
      "https://phishdestroy.io/steam_dossier/de/elite_skins.html",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/csfloat-catalogue.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/skinport-floor-over-cap.json",
      "https://pricempire.com/cs2-marketplaces",
      "https://web.archive.org/web/20260921022459/https://pricempire.com/cs2-marketplaces",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/priceempire-marketplaces.json",
      "https://www.steamanalyst.com/marketplace",
      "https://web.archive.org/web/20260719014552/https://www.steamanalyst.com/marketplace",
      "https://help.steampowered.com/en/faqs/view/61F0-72B7-9A18-C70B",
      "https://web.archive.org/web/20260921022227/https://help.steampowered.com/en/faqs/view/61F0-72B7-9A18-C70B",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/cs2sh-atlas.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/cs2sh-manifest.json",
      "https://phishdestroy.io/steam_dossier/de/skin_atlas.html",
      "https://phishdestroy.io/steam_dossier/de/steam_enforcement_evidence.html#case-support-recovery",
      "https://top10.owasp.org/2025/A01_2025-Broken_Access_Control/",
      "https://web.archive.org/web/20260920212535/https://top10.owasp.org/2025/A01_2025-Broken_Access_Control/",
      "https://store.steampowered.com/privacy_agreement/",
      "https://web.archive.org/web/20260921021648/https://store.steampowered.com/privacy_agreement/",
      "https://www.dexerto.com/csgo/csgo-skins-worth-millions-allegedly-stolen-with-help-from-steam-support-staff-2066939/",
      "https://web.archive.org/web/20250818113925/https://www.dexerto.com/csgo/csgo-skins-worth-millions-allegedly-stolen-with-help-from-steam-support-staff-2066939/",
      "https://www.dexerto.com/counter-strike-2/valve-saves-hacked-cs2-player-threatened-with-ransom-over-300000-of-rare-stickers-3283135/",
      "https://www.dexerto.com/csgo/over-2-million-in-csgo-skins-stolen-from-hacked-steam-account-1853092/",
      "https://web.archive.org/web/20220702042821/https://www.dexerto.com/csgo/over-2-million-in-csgo-skins-stolen-from-hacked-steam-account-1853092/",
      "https://www.kaspersky.com/blog/cs-go-two-million-usd-inventory-hack/44697/",
      "https://esportfire.com/article/the-2-million-usd-csgo-hack-22062022",
      "https://web.archive.org/web/20260515110250/https://esportfire.com/article/the-2-million-usd-csgo-hack-22062022",
      "https://esportsbetting.com/valve-deletes-130000-stolen-dragon-lore/",
      "https://esportfire.com/article/the-biggest-hack-in-csgo-history-csmoney-14082022",
      "https://web.archive.org/web/20251115173120/https://esportfire.com/article/the-biggest-hack-in-csgo-history-csmoney-14082022",
      "https://vkplay.ru/media/news/bloger-rasskazal-kak-podderzhka-steam-vorovala-akkaunty-igrokov/",
      "https://lis-skins.com/ru/blog/krupneisaia-mosenniceskaia-sxema-v-istorii-steam/",
      "https://escorenews.com/ru/csgo/news/44056-sotrudniki-podderjki-steam-zanimalis-krajey-skinov-s-akkauntov-za-god-oni-zarabotali-svyshe-300-tysyach-dollarov",
      "https://www.reddit.com/r/cs2/comments/1h53qp3/steam_support_is_stealing_accounts_again/",
      "https://web.archive.org/web/20250805141942/https://www.reddit.com/r/cs2/comments/1h53qp3/steam_support_is_stealing_accounts_again/",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/outsourcing-archive-records.json",
      "https://community.skin.club/en/news/collector-has-steam-inventory-returned-after-bold-hack",
      "https://esportfire.com/article/300k-scam-full-katowice-2014-holo-collection-hacked",
      "https://web.archive.org/web/20251217072445/https://esportfire.com/article/300k-scam-full-katowice-2014-holo-collection-hacked",
      "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng",
      "https://web.archive.org/web/20260920024236/https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng",
      "https://ag.ny.gov/press-release/2026/attorney-general-james-sues-game-developer-promoting-illegal-gambling-through",
      "https://web.archive.org/web/20260901015430/https://ag.ny.gov/press-release/2026/attorney-general-james-sues-game-developer-promoting-illegal-gambling-through",
      "https://www.fincen.gov/sites/default/files/2019-05/FinCEN%20CVC%20Guidance%20FINAL.pdf",
      "https://web.archive.org/web/20250711185007/https://www.fincen.gov/sites/default/files/2019-05/FinCEN%20CVC%20Guidance%20FINAL.pdf",
      "https://eur-lex.europa.eu/legal-content/EN/LSU/?uri=CELEX:32018L1673",
      "https://eur-lex.europa.eu/eli/dir/2024/1640/oj/eng",
      "https://web.archive.org/web/20260830153004/https://eur-lex.europa.eu/eli/dir/2024/1640/oj/eng",
      "https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng",
      "https://web.archive.org/web/20260920080125/https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng",
      "https://phishdestroy.io/steam_dossier/de/legal_analysis.html",
      "https://partner.steamgames.com/doc/features/auth#website",
      "https://web.archive.org/web/20260921022335/https://partner.steamgames.com/doc/features/auth",
      "https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa",
      "https://web.archive.org/web/20260921070051/https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/gdpr-ticket-1.png",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/screenshot-manifest.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/gdpr-ticket-2.png",
      "https://datenschutz.hamburg.de/beschwerde",
      "https://edpb.europa.eu/",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/regulatory-review/disclosure-audit.json",
      "https://phishdestroy.medium.com/my-dog-vs-elite-gdpr-lawyers-the-valve-data-breach-nobody-is-talking-about-f6f7683d813d",
      "https://web.archive.org/web/20260821155801/https://phishdestroy.medium.com/my-dog-vs-elite-gdpr-lawyers-the-valve-data-breach-nobody-is-talking-about-f6f7683d813d",
      "https://phishdestroy.io/steam_dossier/index#exhibit-gallery-section",
      "https://github.com/ValveSoftware/steam-for-linux/issues/4521",
      "https://phishdestroy.io/steam_dossier/de/steam_evidence_archive.html?source=GitHub&record=484",
      "https://github.com/ValveSoftware/steam-for-linux/issues/6459",
      "https://web.archive.org/web/20260419051343/https://github.com/ValveSoftware/steam-for-linux/issues/6459",
      "https://phishdestroy.io/steam_dossier/de/steam_evidence_archive.html?source=GitHub&record=467",
      "https://github.com/ValveSoftware/Source-1-Games/issues/3857",
      "https://phishdestroy.io/steam_dossier/de/steam_evidence_archive.html?source=GitHub&record=768",
      "https://www.reddit.com/r/DotA2/comments/vt76ov/funds_stolen_through_steam_market_disappointed/",
      "https://web.archive.org/web/20250320082450/https://www.reddit.com/r/DotA2/comments/vt76ov/funds_stolen_through_steam_market_disappointed/",
      "https://phishdestroy.io/steam_dossier/de/steam_evidence_archive.html?source=Reddit&record=4533",
      "https://www.reddit.com/r/ohnePixel/comments/1hahqx2/permanently_banned_steam_account_without_a_clear/",
      "https://phishdestroy.io/steam_dossier/de/steam_evidence_archive.html?source=Reddit&record=4766",
      "https://www.reddit.com/r/legaladvice/comments/1kipjde/got_10k_stollen_from_steam_inventory_due_to_steam/",
      "https://phishdestroy.io/steam_dossier/de/steam_evidence_archive.html?source=Reddit&record=4592",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/selected-evidence-records.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/archive_manifest.json",
      "https://phishdestroy.io/steam_dossier/de/card_economy.html",
      "https://github.com/JustArchiNET/ArchiSteamFarm/wiki/FAQ",
      "https://phishdestroy.io/steam_dossier/de/card_economy.html#scale",
      "https://phishdestroy.io/steam_dossier/de/card_economy.html#licence",
      "https://phishdestroy.io/steam_dossier/de/enforcement_audit.html",
      "https://github.com/JustArchiNET/ArchiSteamFarm",
      "https://web.archive.org/web/20260924181709/https://github.com/JustArchiNET/ArchiSteamFarm",
      "https://rdap.verisign.com/com/v1/domain/csgoempire.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgoempire.com",
      "https://rdap.verisign.com/com/v1/domain/csgoempirelogin4.com",
      "https://rdap.verisign.com/com/v1/domain/rustreaper.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frustreaper.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustreaper.com.json",
      "https://rdap.verisign.com/com/v1/domain/rustly.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frustly.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustly.com.json",
      "https://rdap.verisign.com/com/v1/domain/csgofast.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgofast.com",
      "https://rdap.verisign.com/com/v1/domain/authtofast.com",
      "https://rdap.verisign.com/com/v1/domain/duelbits.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fduelbits.com",
      "https://rdap.verisign.com/com/v1/domain/switchflips.com",
      "https://rdap.verisign.com/com/v1/domain/farmskins.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ffarmskins.com",
      "https://tld-rdap.verisign.com/cc/v1/domain/kobal.cc",
      "https://rdap.verisign.com/com/v1/domain/csgoluck.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgoluck.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgoluck.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/insane.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Finsane.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/insane.gg.json",
      "https://rdap.verisign.com/com/v1/domain/cs2skin.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcs2skin.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/cs2skin.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/juice.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fjuice.gg",
      "https://rdap.verisign.com/com/v1/domain/letmeinjuice.com",
      "https://rdap.verisign.com/com/v1/domain/ggdrop.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fggdrop.com",
      "https://rdap.verisign.com/com/v1/domain/ggauth.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/howl.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fhowl.gg",
      "https://rdap.radix.host/rdap/domain/howl.uno",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/chicken.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fchicken.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/chicken.gg.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/csgocasino.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgocasino.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgocasino.gg.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/hunt.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fhunt.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/hunt.gg.json",
      "https://rdap.verisign.com/com/v1/domain/csbattle.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsbattle.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csbattle.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/skinrave.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinrave.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinrave.gg.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/csdouble.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsdouble.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csdouble.gg.json",
      "https://rdap.verisign.com/com/v1/domain/rustchance.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frustchance.com",
      "https://rdap.verisign.com/com/v1/domain/hgfuihd.com",
      "https://rdap.radix.host/rdap/domain/cobaltlab.tech",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcobaltlab.tech",
      "https://rdap.verisign.com/com/v1/domain/cobaltauth.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/raided.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fraided.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/raided.gg.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/rustneo.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frustneo.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustneo.gg.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/splits.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fsplits.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/splits.gg.json",
      "https://rdap.identitydigital.services/rdap/domain/upgrader.pro",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fupgrader.pro",
      "https://rdap.radix.host/rdap/domain/upgauth.space",
      "https://rdap.centralnic.com/fans/domain/skin.fans",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskin.fans",
      "https://rdap.nic.one/domain/hotpizza.one",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fhotpizza.one",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/hotpizza.one.json",
      "https://rdap.verisign.com/com/v1/domain/g4skins.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fg4skins.com",
      "https://rdap.verisign.com/com/v1/domain/tf2royal.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ftf2royal.com",
      "https://rdap.verisign.com/com/v1/domain/tf2auth.com",
      "https://rdap.verisign.com/com/v1/domain/tf2hunt.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ftf2hunt.com",
      "https://rdap.verisign.com/com/v1/domain/rstspcl.com",
      "https://rdap.identitydigital.services/rdap/domain/tf2.bet",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ftf2.bet",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tf2.bet.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/openstars.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fopenstars.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/openstars.gg.json",
      "https://rdap.verisign.com/com/v1/domain/skins.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskins.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skins.com.json",
      "https://rdap.identitydigital.services/rdap/domain/white.market",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fwhite.market",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/white.market.json",
      "https://rdap.identitydigital.services/rdap/domain/moon.market",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fmoon.market",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/moon.market.json",
      "https://rdap.verisign.com/com/v1/domain/csfloat.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsfloat.com",
      "https://rdap.verisign.com/com/v1/domain/csgofloat.com",
      "https://rdap.identitydigital.services/rdap/domain/skin.land",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskin.land",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skin.land.json",
      "https://rdap.verisign.com/com/v1/domain/haloskins.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fhaloskins.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/haloskins.com.json",
      "https://rdap.verisign.com/com/v1/domain/163.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fbuff.163.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/buff.163.com.json",
      "https://rdap.verisign.com/com/v1/domain/csgo.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fmarket.csgo.com",
      "https://rdap.verisign.com/net/v1/domain/dota2.net",
      "https://rdap.verisign.com/com/v1/domain/skinport.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinport.com",
      "https://pubapi.registry.google/rdap/domain/skinport.app",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/skinflow.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinflow.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinflow.gg.json",
      "https://rdap.identitydigital.services/rdap/domain/skin.place",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskin.place",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skin.place.json",
      "https://rdap.verisign.com/com/v1/domain/skinsmonkey.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinsmonkey.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinsmonkey.com.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinbaron.de",
      "https://rdap.verisign.com/com/v1/domain/skinbaron.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frust.tm",
      "https://rdap.verisign.com/com/v1/domain/pirateswap.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fpirateswap.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/pirateswap.com.json",
      "https://rdap.radix.host/rdap/domain/mannco.store",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fmannco.store",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/mannco.store.json",
      "https://rdap.verisign.com/com/v1/domain/skinswap.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinswap.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinswap.com.json",
      "https://rdap.verisign.com/com/v1/domain/exeskins.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fexeskins.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/exeskins.com.json",
      "https://rdap.verisign.com/com/v1/domain/balticskins.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fbalticskins.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/balticskins.com.json",
      "https://rdap.nic.trade/domain/cs.trade",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcs.trade",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/cs.trade.json",
      "https://rdap.verisign.com/com/v1/domain/rapidskins.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frapidskins.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rapidskins.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/tradeit.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ftradeit.gg",
      "https://rdap.verisign.com/com/v1/domain/connect-tradeit.com",
      "https://rdap.verisign.com/com/v1/domain/49skins.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2F49skins.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/49skins.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/skinvault.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinvault.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinvault.gg.json",
      "https://rdap.identitydigital.services/rdap/domain/aim.market",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Faim.market",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/aim.market.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/skinout.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinout.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinout.gg.json",
      "https://rdap.verisign.com/com/v1/domain/ntskins.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fntskins.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/ntskins.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/gamerpay.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fgamerpay.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/gamerpay.gg.json",
      "https://rdap.nic.tf/domain/scrap.tf",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fscrap.tf",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/scrap.tf.json",
      "https://rdap.nic.tf/domain/marketplace.tf",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fmarketplace.tf",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/marketplace.tf.json",
      "https://rdap.identitydigital.services/rdap/domain/skins.cash",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskins.cash",
      "https://rdap.identitydigital.services/rdap/domain/skinscash.live",
      "https://rdap.verisign.com/net/v1/domain/csgo.net",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgo.net",
      "https://rdap.verisign.com/net/v1/domain/easylot.net",
      "https://rdap.verisign.com/net/v1/domain/cybershoke.net",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcybershoke.net",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/cybershoke.net.json",
      "https://rdap.verisign.com/net/v1/domain/fastcup.net",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ffastcup.net",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/fastcup.net.json",
      "https://rdap.verisign.com/com/v1/domain/leetify.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fleetify.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/leetify.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/scope.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fscope.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/scope.gg.json",
      "https://rdap.verisign.com/com/v1/domain/tradeupspy.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ftradeupspy.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tradeupspy.com.json",
      "https://rdap.identitydigital.services/rdap/domain/cs.deals",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcs.deals",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/cs.deals.json",
      "https://rdap.verisign.com/com/v1/domain/pricempire.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fpricempire.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/pricempire.com.json",
      "https://rdap.identitydigital.services/rdap/domain/lzt.market",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Flzt.market",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/lzt.market.json",
      "https://rdap.verisign.com/com/v1/domain/z2u.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fz2u.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/z2u.com.json",
      "https://rdap.verisign.com/com/v1/domain/csgoroll.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgoroll.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgoroll.com.json",
      "https://rdap.verisign.com/com/v1/domain/rollbit.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frollbit.com",
      "https://rdap.verisign.com/com/v1/domain/rbsnin.com",
      "https://rdap.identitydigital.services/rdap/domain/500.casino",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2F500.casino",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/500.casino.json",
      "https://rdap.verisign.com/com/v1/domain/csgobig.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgobig.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgobig.com.json",
      "https://rdap.verisign.com/com/v1/domain/casedrop.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcasedrop.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/casedrop.com.json",
      "https://rdap.verisign.com/com/v1/domain/banditcamp.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fbanditcamp.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/banditcamp.com.json",
      "https://rdap.verisign.com/com/v1/domain/skinbox.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinbox.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinbox.com.json",
      "https://rdap.verisign.com/com/v1/domain/tastydrop.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ftastydrop.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tastydrop.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/csgopolygon.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgopolygon.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgopolygon.gg.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/magicdrop.ru.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fmagicdrop.ru",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/magicdrop.ru.json",
      "https://rdap.verisign.com/com/v1/domain/csdice.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsdice.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csdice.com.json",
      "https://rdap.verisign.com/com/v1/domain/skinodds.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinodds.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinodds.com.json",
      "https://rdap.verisign.com/com/v1/domain/csgowin.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgowin.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgowin.com.json",
      "https://rdap.verisign.com/net/v1/domain/csgorun.net",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgorun.net",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgorun.net.json",
      "https://rdap.verisign.com/com/v1/domain/openskins.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fopenskins.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/openskins.com.json",
      "https://rdap.verisign.com/com/v1/domain/rustbet.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frustbet.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustbet.com.json",
      "https://rdap.verisign.com/com/v1/domain/csgomagic.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgomagic.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgomagic.com.json",
      "https://rdap.verisign.com/com/v1/domain/csgobounty.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgobounty.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgobounty.com.json",
      "https://rdap.verisign.com/com/v1/domain/ezskins.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fezskins.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/ezskins.com.json",
      "https://rdap.verisign.com/com/v1/domain/rustcases.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frustcases.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustcases.com.json",
      "https://rdap.verisign.com/com/v1/domain/csgoreaper.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgoreaper.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgoreaper.com.json",
      "https://rdap.verisign.com/com/v1/domain/csgocases.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgocases.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgocases.com.json",
      "https://rdap.verisign.com/com/v1/domain/csgo-skins.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgo-skins.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgo-skins.com.json",
      "https://rdap.verisign.com/com/v1/domain/csgonet.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgonet.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgonet.com.json",
      "https://rdap.verisign.com/com/v1/domain/wtfskins.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fwtfskins.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/wtfskins.com.json",
      "https://rdap.verisign.com/com/v1/domain/flamecases.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fflamecases.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/flamecases.com.json",
      "https://rdap.verisign.com/com/v1/domain/gamedom.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fgamedom.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/gamedom.com.json",
      "https://rdap.nic.club/domain/skin.club",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskin.club",
      "https://rdap.verisign.com/net/v1/domain/sc-auth.net",
      "https://rdap.verisign.com/com/v1/domain/daddyskins.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fdaddyskins.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/daddyskins.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/rustix.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frustix.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustix.gg.json",
      "https://rdap.nic.club/domain/skins.club",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskins.club",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skins.club.json",
      "https://rdap.publicinterestregistry.org/rdap/domain/csgohouse.org",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgohouse.org",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgohouse.org.json",
      "https://rdap.verisign.com/net/v1/domain/skinrave.net",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinrave.net",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinrave.net.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/bloodycase.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fbloodycase.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/bloodycase.gg.json",
      "https://rdap.verisign.com/com/v1/domain/csgoclicker.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgoclicker.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgoclicker.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/rustbet.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frustbet.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustbet.gg.json",
      "https://rdap.verisign.com/com/v1/domain/cs-drop.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcs-drop.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/cs-drop.com.json",
      "https://rdap.verisign.com/net/v1/domain/hellstore.net",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fhellstore.net",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/hellstore.net.json",
      "https://rdap.verisign.com/com/v1/domain/rustloot.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frustloot.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustloot.com.json",
      "https://rdap.verisign.com/com/v1/domain/csgo-case.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgo-case.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgo-case.com.json",
      "https://rdap.verisign.com/com/v1/domain/csgogem.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgogem.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgogem.com.json",
      "https://rdap.verisign.com/com/v1/domain/rainbet.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frainbet.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rainbet.com.json",
      "https://rdap.verisign.com/com/v1/domain/rustclash.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frustclash.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustclash.com.json",
      "https://rdap.identitydigital.services/rdap/domain/12cs.fail",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2F12cs.fail",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/12cs.fail.json",
      "https://rdap.verisign.com/com/v1/domain/tf2easy.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fwww.tf2easy.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tf2easy.com.json",
      "https://rdap.verisign.com/com/v1/domain/tf2blaze.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ftf2blaze.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tf2blaze.com.json",
      "https://rdap.verisign.com/com/v1/domain/shuffle.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fshuffle.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/shuffle.com.json",
      "https://rdap.identitydigital.services/rdap/domain/buff.market",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fbuff.market",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/buff.market.json",
      "https://rdap.identitydigital.services/rdap/domain/avan.market",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Favan.market",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/avan.market.json",
      "https://rdap.identitydigital.services/rdap/domain/cs.money",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcs.money",
      "https://rdap.verisign.com/com/v1/domain/uuskins.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fuuskins.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/uuskins.com.json",
      "https://rdap.verisign.com/com/v1/domain/youpin898.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fyoupin898.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/youpin898.com.json",
      "https://rdap.verisign.com/com/v1/domain/c5game.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fc5game.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/c5game.com.json",
      "https://rdap.verisign.com/com/v1/domain/waxpeer.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fwaxpeer.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/waxpeer.com.json",
      "https://rdap.verisign.com/com/v1/domain/dmarket.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fdmarket.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/dmarket.com.json",
      "https://rdap.verisign.com/com/v1/domain/steamcommunity.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fsteamcommunity.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/steamcommunity.com.json",
      "https://rdap.verisign.com/com/v1/domain/lootfarm.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Flootfarm.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/lootfarm.com.json",
      "https://rdap.verisign.com/com/v1/domain/rustskins.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frustskins.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustskins.com.json",
      "https://rdap.verisign.com/com/v1/domain/krakatoa.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fkrakatoa.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/krakatoa.com.json",
      "https://rdap.verisign.com/com/v1/domain/shadowpay.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fshadowpay.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/shadowpay.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/igxe.cn.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Figxe.cn",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/igxe.cn.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/swap.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fswap.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/swap.gg.json",
      "https://rdap.verisign.com/com/v1/domain/bitskins.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fbitskins.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/bitskins.com.json",
      "https://rdap.verisign.com/com/v1/domain/tf2mart.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ftf2mart.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tf2mart.com.json",
      "https://rdap.verisign.com/com/v1/domain/skinbid.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinbid.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinbid.com.json",
      "https://rdap.verisign.com/com/v1/domain/lootbear.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Flootbear.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/lootbear.com.json",
      "https://rdap.nic.tf/domain/backpack.tf",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fbackpack.tf",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/backpack.tf.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fstntrading.eu",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/stntrading.eu.json",
      "https://rdap.verisign.com/com/v1/domain/skinwallet.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinwallet.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinwallet.com.json",
      "https://rdap.verisign.com/com/v1/domain/dota2market.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fdota2market.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/dota2market.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/xplay.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fxplay.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/xplay.gg.json",
      "https://rdap.verisign.com/com/v1/domain/esportal.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fesportal.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/esportal.com.json",
      "https://rdap.registro.br/domain/gamersclub.com.br",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fgamersclub.com.br",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/gamersclub.com.br.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/epidemic.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fepidemic.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/epidemic.gg.json",
      "https://rdap.verisign.com/com/v1/domain/cs2stash.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcs2stash.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/cs2stash.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/csgoskins.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgoskins.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgoskins.gg.json",
      "https://rdap.verisign.com/com/v1/domain/steamanalyst.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fsteamanalyst.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/steamanalyst.com.json",
      "https://rdap.verisign.com/net/v1/domain/steamcardexchange.net",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fsteamcardexchange.net",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/steamcardexchange.net.json",
      "https://rdap.verisign.com/com/v1/domain/dotabuff.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fdotabuff.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/dotabuff.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/tracker.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ftracker.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tracker.gg.json",
      "https://rdap.verisign.com/com/v1/domain/funpay.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ffunpay.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/funpay.com.json",
      "https://rdap.verisign.com/com/v1/domain/playerauctions.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fplayerauctions.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/playerauctions.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/eldorado.gg.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Feldorado.gg",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/eldorado.gg.json",
      "https://rdap.verisign.com/com/v1/domain/g2a.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fg2a.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/g2a.com.json",
      "https://rdap.verisign.com/net/v1/domain/kinguin.net",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fkinguin.net",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/kinguin.net.json",
      "https://rdap.verisign.com/com/v1/domain/g2g.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fg2g.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/g2g.com.json",
      "https://rdap.verisign.com/com/v1/domain/playerup.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fplayerup.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/playerup.com.json",
      "https://rdap.verisign.com/net/v1/domain/smurfhub.net",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fsmurfhub.net",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/smurfhub.net.json",
      "https://rdap.verisign.com/com/v1/domain/smurfaccounts.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fsmurfaccounts.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/smurfaccounts.com.json",
      "https://rdap.verisign.com/com/v1/domain/buycsgorank.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fbuycsgorank.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/buycsgorank.com.json",
      "https://rdap.verisign.com/com/v1/domain/csgosmurfkings.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgosmurfkings.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgosmurfkings.com.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/smurfstore.co.json",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fsmurfstore.co",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/smurfstore.co.json",
      "https://rdap.verisign.com/com/v1/domain/steamlvlup.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fsteamlvlup.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/steamlvlup.com.json",
      "https://rdap.verisign.com/com/v1/domain/steamlevels.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fsteamlevels.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/steamlevels.com.json",
      "https://rdap.verisign.com/com/v1/domain/levelsteam.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Flevelsteam.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/levelsteam.com.json",
      "https://rdap.verisign.com/com/v1/domain/steamlevelu.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fsteamlevelu.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/steamlevelu.com.json",
      "https://rdap.verisign.com/com/v1/domain/eloking.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Feloking.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/eloking.com.json",
      "https://rdap.publicinterestregistry.org/rdap/domain/boosteria.org",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fboosteria.org",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/boosteria.org.json",
      "https://rdap.verisign.com/com/v1/domain/overgear.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fovergear.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/overgear.com.json",
      "https://rdap.verisign.com/com/v1/domain/blazingboost.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fblazingboost.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/blazingboost.com.json",
      "https://rdap.verisign.com/com/v1/domain/dota2boost.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fdota2boost.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/dota2boost.com.json",
      "https://rdap.verisign.com/com/v1/domain/buyboost.com",
      "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fbuyboost.com",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/buyboost.com.json",
      "https://help.steampowered.com/en/faqs/view/365F-4BEE-2AE2-7BDD",
      "https://store.steampowered.com/privacy_agreement/#8",
      "https://www.edpb.europa.eu/system/files/2023-04/edpb_guidelines_202201_data_subject_rights_access_v2_en.pdf",
      "https://web.archive.org/web/20260810154631/https://store.steampowered.com/stats/support",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/part2-measurements.json",
      "https://phishdestroy.io/steam_dossier/VALVE_EVIDENCE_PACK/databases/TOTAL_VALVE_SCANDALS_MASTER_DB.csv",
      "https://phishdestroy.io/steam_dossier/de/license_disclaimer.html"
    ]
  }
}