{
  "schema": "phishdestroy.print-bundle.v1",
  "language": "en",
  "title": "The Steam Dossier",
  "exported_at": "2026-09-29T00:26:03.585Z",
  "scope": "Research reading edition. Complete chapter prose is retained. Raster images and named catalogues are linked instead of embedded. The five supplementary evidence archives listed below are excluded. Authored chapter prose uses the selected language. Collected evidence, quotations and source table rows retain their original language.",
  "excluded_sources": [
    "https://phishdestroy.io/steam_dossier/valve_scandals_registry",
    "https://phishdestroy.io/steam_dossier/steam_evidence_archive",
    "https://phishdestroy.io/steam_dossier/steam_enforcement_evidence",
    "https://phishdestroy.io/steam_dossier/support_canned_refusals",
    "https://phishdestroy.io/steam_dossier/social_graph"
  ],
  "license": {
    "identifier": "CC0-1.0",
    "url": "https://creativecommons.org/publicdomain/zero/1.0/",
    "rights_statement": "https://phishdestroy.io/steam_dossier/steam_tos_assets/license-rights.json",
    "rights_statement_sha256": "80d67354f8e5efd65b03696be950fb0f95c188d0089b1604281d0a4daff3f4cb",
    "third_party_rights": "Third-party materials retain their own rights."
  },
  "pdf": {
    "filename": "steam-dossier-en.pdf",
    "sha256": "9ec6a974475e9e139e65e4f2314015cb06639edcacd422f3db0310097064c0d4",
    "bytes": 1680895,
    "pages": 190
  },
  "integrity": {
    "signed_object": "steam-dossier-en.content.json",
    "signature_file": "steam-dossier-en.content.json.asc",
    "digest_file": "steam-dossier-en.content.json.sha256",
    "signing_key_fingerprint": "129FC7F39C40C69D2EF3C329BFCF9E8DD295EE01",
    "public_key": "https://phishdestroy.io/.well-known/pgp-key.txt",
    "scope": "Detached OpenPGP signature covers the exact UTF-8 bytes of this JSON, including chapter text and PDF SHA-256.",
    "verify": "gpg --verify steam-dossier-en.content.json.asc steam-dossier-en.content.json"
  },
  "documents": [
    {
      "source": "https://phishdestroy.io/steam_dossier/index",
      "language": "en",
      "title": "The Steam Dossier: rules, routes and accountability",
      "start_page": 2,
      "end_page": 99,
      "editorial_scope": {
        "policy": "Research prose, conclusions, methodological limits and analytical tables retained without paragraph truncation. Named catalogues and visual galleries are linked; raster images are not embedded.",
        "linked_sections": [
          {
            "id": "exhibit-gallery-section",
            "source": "https://phishdestroy.io/steam_dossier/index#exhibit-gallery-section"
          }
        ],
        "raster_images_replaced": 2
      },
      "content": {
        "text": "Dieses Material ist auf Englisch verfügbar.Zurück zum Dossier · Deutsch ↗\nTL;DR — 5 VERIFIABLE CLAIMSAll 5 verifiable against Valve's own servers, documents and published dates\n44\n\nseparate auth-host domains found carrying Steam logins for third-party platforms — each a domain registered apart from the platform's main address.\n\nSection 3 →\n26\n\nfilter-split pairs: main domain shows a Steam Link Filter warning; the login host beside it does not.\n\nSection 3.2 →\n12y 6m\n\nis how long api.csgem.com has carried Steam logins while csgogem.com sits on the Link Filter. Registered March 2014.\n\nView table →\n10 days\n\nwas Valve's own 2016 deadline to gambling operators. No per-operator enforcement record has been published since.\n\nSection 2 →\n830 pp\n\nArt. 15 GDPR response from Valve's lawyers — 902,270 characters of extractable redactions, redaction bars left as selectable text.\n\nSection 18 →\nWHAT THIS MEANS — THE STEAM LINK FILTER\n\nValve maintains a link filter that blocks links to gambling and trading sites when posted in Steam chat or profile comments. When a user clicks a blocked link, Valve displays a full-screen warning: \"This link has been flagged as potentially malicious.\" However, Valve only checks the primary website domain. The separate domains used for Steam OpenID authentication are not on the blocklist — so the login flow succeeds even though the main site is blocked.\n\nWhat this means — OpenID and openid.realm\n\nOpenID is the sign-in standard behind the “Sign in with Steam” button: the site does not receive the password, Steam confirms the identity to it. openid.realm is the field carrying the address of the site asking for the sign-in, and openid.return_to the address Steam is to send the user back to. Steam receives both on every request and prints the realm on its own login page — which is why this dossier can name the host each platform authenticates through.\n\nSection 3 — the observed routes →\n\nSection 1 — Case briefing\nThe rule. The record. The unanswered questions.\nContext & source limits\n\nSix findings, each tied to a dated public record. The detailed sections follow the same order: technical record (Part A), rules and enforcement record (Part B), legal frameworks (Part C), then the appendices with the primary exhibits.\n\nSix findings. Each connects a written rule to a dated record and a question the evidence can test.\n\n1. Separate-domain auth hosts — 44 routes · 26 split pairs\n\nThe live register records 44 platforms authenticating through a separate registrable domain. Five further routes sit in pending verification awaiting an RDAP date; promoting them would take the total to 47. They are excluded from 44 and from the age chart. — 27 with a published per-route evidence file and 17 added from manual collection, listed apart. In 26 filter-split pairs the main domain is BLOCKED in the Steam Link Filter while the proxy carrying its login is not. These are not burner domains: csgogem.com is blocked while api.csgem.com, the host carrying its Steam login, has been registered since March 2014 — 12 years 6 months. Valve receives that hostname in every OpenID request, and renders it back to the user on its own login page. Full table, per-route ages and sourcing in Section 3.\n\nFollow the route →\n2. 2016: the mechanism was named, the deadline set\n\nOn 13 July 2016 Valve publicly described how gambling sites used Steam OpenID and automated trading accounts, and its counsel's notices of 20 July 2016 set a ten-day deadline. No per-operator enforcement record has been published since. Ten years after that deadline was issued, the same named mechanism is in use on separate-domain auth hosts that returned no Link Filter block on 2026-09-21.\n\nRead the open letter to the WSGC →\n3. Device correlation, on counsel's letterhead\n\nIn the correspondence reproduced here, Valve's counsel described device-level correlation linking one device to multiple accounts — a capability Steam Support had previously told users was not technically possible. The open question is which device-level records Valve holds and on what basis account holders are refused access to them.\n\nRead the memorandum →\n4. Two access responses. One withheld the data, one leaked it.\n\nOctober 2025: Valve's counsel answered an Art. 15 request with an 830-page appendix whose redactions are painted over the text instead of removing it — 902,270 characters come back out with a standard extraction tool, including the third-party identifiers the bars were there to withhold. Art. 15(4) is the reason those bars exist. September 2026: ticket HT-2YBP-F7JP-D4VB was closed after three days with a link to the self-service Account Data page — no data, no stated legal basis. The one-month period under Art. 12(3) had not expired at publication; the objection is to the substance.\n\nRead the redaction check →Read the ticket record →\n5. The market above Steam's ceiling\n\nSteam caps a Market listing at about $1,800. Across five marketplaces in a dated snapshot (23 Sep 2026), 248 CS2 item categories are priced above that cap by two or more of them independently, and all 248 are absent from Steam; a Factory New Dragon Lore starts at $10,941 across 389 copies listed on all five (the CSFloat-only figure in Section 13, from the 20 Sep snapshot, is $10,623.95 across 62 offers). Selling at those prices requires an outside venue, while item transfer still runs through Steam.\n\nFollow the price and transfer →\n6. The rule is explicit; the audit trail is not\n\nThe Subscriber Agreement reserves Steam for personal, non-commercial use, bars commercial exploitation except as expressly permitted, prohibits scripts and bots, and allows account termination. Valve applied that language to gambling operators in 2016. Separately, according to CSFloat's engineering account, Valve closed IEconItems_730/GetPlayerItems in 2017, removing public access to original item IDs (no Valve changelog located).\n\nPut the rule beside the network →\n2016 / Written demand 10 days\nDeadline in Valve counsel's July 2016 notices to gambling sites. Open letter to the WSGC: Section 2.\n2017 / Public audit trail ID access closed\nCSFloat records the loss of original item IDs.\nCounsel correspondence Device correlation\nOne device linked to dozens of stolen accounts.\nRoute register Blocked, and still logging in\nThe rule: Valve's 2016 statement prohibits running a gambling business on Steam OpenID. The record: 26 main domains sit on the Link Filter while the host carrying each one's Steam login runs on — csgogem.com's has run 12 years 6 months.\nSection 2 — Open letter\nOpen letter to the Washington State Gambling Commission\n\nTen days became ten years. The Commission's 2016 question to Valve has not been answered with an operator-by-operator record; this letter asks it to reopen the file.\n\nPUBLIC ADDRESS · WASHINGTON STATE GAMBLING COMMISSION\n\nTen days became ten years.Reopen the record.\n\nTo the Washington State Gambling Commission:\n\nIn 2016, Director David Trujillo asked Valve to show what it had done to stop the use of Steam skins for gambling. Then-Chair Chris Stearns and the Commission confronted an industry built on Valve-issued items and Steam transfers. Both men have since left their Commission roles. The question they put to Valve has not expired.\n\nValve's general counsel, Karl Quackenbush, gave gambling operators ten days to stop commercial use of Steam accounts. In its October response to your Commission, Valve denied facilitating gambling, said it had sent cease-and-desist letters to more than forty sites and said it had disabled associated accounts. It also defended preserving Steam trading and OpenID because those services benefited customers and game developers. That was an assertion of control. It deserves a test, not deference.\n\nIn our assessment, Valve's answer did not demonstrate that its chosen enforcement matched the scale of the network it described. A threatening letter to an operator is not the same thing as a durable block on the Steam accounts, trading infrastructure and authentication routes that make the business work. Reported estimates put CS:GO Lounge alone above $1 billion in betting handle during 2016; that is an outside estimate of wagers, not Valve revenue, and the site's original skin-betting operation later shut down. The scale made verifiable enforcement essential.\n\nToday, Valve's own Subscriber Agreement archived 2026-09-21 ↗ restricts commercial exploitation except where expressly permitted and separately prohibits specified forms of automation. Our dated route register records declared OpenID return hosts for outside services; openid.realm and openid.return_to are fields sent to Steam, not secrets hidden from it. Our Link Filter checks show cases where a main address was warned against but an associated login host was not. A filter result alone cannot prove that Valve allowed a login or that a particular bot evaded an account ban. It does prove that a homepage warning cannot be offered as a complete answer about access.\n\nNor can the existence of useful, lawful Steam trading and OpenID functions answer whether prohibited operators were actually excluded. Valve's own rules allow express exceptions. If Valve relies on that distinction, the Commission should ask it to identify the authorisation, account controls and enforcement criteria applicable to commercial skin businesses, and the specific non-gambling uses it invoked in 2016. The mere possibility of lawful use is no answer to documented prohibited use.\n\nWe ask the Commission to revisit its 2016 file and request an operator-by-operator account: which Steam accounts and trading bots were disabled after the ten-day notices; whether related accounts or return hosts were monitored; which operators later regained access; what exemptions were granted; and what records support Valve's statement to the Commission. Publish what law allows the public to inspect. Compare those records with current routes and with Valve's later interventions, including OPSkins in 2018 archived 2026-03-07 ↗.\n\nThe notice set a ten-day deadline in July 2016; ten years is long enough to establish whether it was carried out. The Commission should test Valve's 2016 account against the infrastructure that remains observable today.\n\nThe Steam Dossier investigation · Public statement, 20 September 2026\n\n2016 Commission notice ↗ archived 2026-05-20 ↗ · Valve's 2016 reply (document copy) ↗ · Valve's 2016 OpenID statement ↗ archived 2026-09-21 ↗ · Current Steam agreement ↗ archived 2026-09-21 ↗ · Timeline of the 2016 exchange: Section 11 →\n\nPart A — Technical record · Section 3\nThe site is blocked. The login route is not.\n\n26 blocked main domains. The authentication proxy behind each one, and how long it has been alive. These separate auth hosts are not incidental second addresses — each one is an authentication proxy for Steam, standing between the platform and Valve's OpenID endpoint and carrying the login the blocked domain can no longer carry in the open. Valve put the front door on the Link Filter. The sign-in kept running through the proxy: csgogem.com is blocked, and api.csgem.com has been registered since March 2014 — twelve and a half years. Every one of those days that host sent its own hostname to Valve's OpenID endpoint, and Steam rendered it straight back to the user on the login page. Valve is the trunk every one of these routes runs through; it does not have to find them. That is what this section measures: not whether a warning exists, but how many years the route behind the warning stays open. 44 separate-domain routes in the register, 27 of them with a published per-route evidence file — the table below. Follow one example, then measure all of them.\n\nFigure 3.1 — The two routes, drawn.\n\nOne platform, one player, two requests leaving the same browser. Valve's Link Filter stands on both. It stops the one that carries a link and passes the one that carries the login. Everything measured in this section is a count of how long the lower route stays open.\n\nThe player\none browser, one session\nrollbit.com\nthe platform's main domain\nrbsnin.com\nseparate authentication host\nLINK FILTER\n✕ BLOCKED\nLINK FILTER\n✓ CLEAN\nsteamcommunity.com\nOpenID endpoint · signs in\nno route\nLink posted in Steam — stoppedLogin request — passesSaved checks of 19 and 21 September 2026\n\nBoth requests are visible to Valve, and only one is acted on. The Link Filter is a Valve list, checked by a Valve service. The OpenID request carries the auth host's own name to Valve's endpoint, which prints it straight back on the login page. The hostname is in the request either way — what differs is whether anything is done with it.\n\nOne platform. Two different routes.ROLLBIT / SAVED OBSERVATIONS\nStep 5 / 5\n\nThe request reaches Steam. The observed route reached Steam's login form. The authors did not complete the login. Blocking the main-domain link did not block this observed route to the form.\n\n01 THE LINK FILTER CHECK\nDESTINATIONrollbit.comThe platform's main domain\nSTEAM LINK FILTERChecks the linkA separate destination-warning system\nSAVED RESULTLink blocked19 & 21 September 2026\n02 THE OBSERVED SIGN-IN ROUTE\nON THE PLATFORMSign in with SteamThe platform starts an OpenID request\nSEPARATE AUTH HOSTrbsnin.comNo Link Filter block in the saved check\nSTEAMLogin form servedThe requested host appears in Steam's notice\nInspect the original capture notes, registration date and protocol details\nWhat Valve's enforcement looks like\nMain domain: blocked\nUser\n→\nrollbit.com\n(main domain)\n↓\nSTEAM LINK FILTER — BLOCKED\n\"Link Blocked!\" — flagged as potentially malicious\nrollbit.com returned a Link Filter block on 2026-09-19 and 2026-09-21 (unauthenticated check; raw HTML and SHA-256 saved). A visible, auditable record.\nWhat actually happens — authentication\nAuth host: not blocked\nUser\n→\nrollbit.com\n\"Sign in with Steam\"\n↓\nRedirect via separate auth host:\nrbsnin.comLink Filter: CLEAN\nregistered 2026-09-18T09:34:52Z (Verisign RDAP)\n↓\nSteam login page notice (2026-09-20):\n\"Note that rbsnin.com is not affiliated with Steam or Valve\"\nSteam renders this notice from the openid.realm of the request it received.\n↓\nSteam login form served for the separate host\nThe login was not completed by the authors; the flow was observed up to the Steam form.\nValve receives the return_to / realm hostname on every such request. rbsnin.com returned no Link Filter block on 2026-09-21.\nPer request\nAs the OpenID provider, Steam receives the auth hostname with every authentication request: it arrives at Valve's own servers in the openid.return_to and openid.realm parameters.\nSent by the site\nThe auth host is not discovered by scanning — the platform sends it to Steam in each request. Under OpenID 2.0 §9.1 return_to is formally optional, but without it Steam cannot deliver the login result, so for a working Steam login it is effectively required. Steam even renders the hostname to the user (\"<host> is not affiliated with Steam or Valve\").\n14 yr\nis the age of the oldest auth host still carrying Steam logins at the 2026-09-21 check (dota2.net, registered 2011-10-29); the newest is three days old (rbsnin.com). Do not read the \"0 auth hosts blocked\" figure as the finding. A blocked auth host would break the platform's \"Sign in with Steam\" outright, so a register built from working logins can only contain hosts that were never blocked. The number that carries meaning is not the block count — it is how many years the main domain sat on the Link Filter while the login beside it kept running.\nSeparate-domain auth hosts: registration date vs. main domain (30 routes: the 25 resolved in the 2026-09-21 browser audit, plus 5 added on 2026-09-22)\nPlatform\tLink Filter: main\tAuth host\tLink Filter: auth host\tAuth host registered\tSource of observation\tEvidence file\nRollbit\nrollbit.com · reg. 2014-11-08\n\tBLOCKED\n2026-09-19, 2026-09-21 · Wayback 2026-09-21\n\trbsnin.com\tCLEAN\n2026-09-21 · raw HTML (no Wayback snapshot)\n\t2026-09-18\n09:34:52Z, Verisign RDAP\n\tSteam login-page notice, 2026-09-20\trollbit.com.json\nSkin.Club\nskin.club · reg. 2017-09-04\n\tBLOCKED\n2026-09-19, 2026-09-21 · Wayback 2026-09-21\n\tsc-auth.net\tCLEAN\n2026-09-21 · Wayback 2026-09-21\n\t2019-04-02\nRDAP\n\tSteam login-page notice\tskin.club.json\nHowl.GG\nhowl.gg · reg. 2017-03-16\n\tBLOCKED\n2026-09-18, 09-19, 09-21 · Wayback 2026-09-21\n\thowl.uno\tCLEAN\n2026-09-21 · Wayback 2026-09-21\n\t2026-08-11\nRDAP\n\tLive browser capture + supplied OpenID URL\thowl.gg.json\nDuelbits\nduelbits.com · reg. 2020-02-03\n\tBLOCKED\n2026-09-21 · Wayback 2026-09-21\n\tswitchflips.com\tCLEAN\n2026-09-21 · Wayback 2026-09-21\n\t2020-04-21\nRDAP\n\tSupplied OpenID URL\tduelbits.com.json\nCSGOFast\ncsgofast.com · reg. 2015-03-27\n\tBLOCKED\n2026-09-19, 2026-09-21 · Wayback 2026-09-21\n\tsteam-login.authtofast.com\tCLEAN\nauthtofast.com, 2026-09-21 · Wayback 2026-09-21\n\t2026-06-30\nauthtofast.com, RDAP\n\tLive browser capture + supplied OpenID URL\tcsgofast.com.json\nFarmskins\nfarmskins.com · reg. 2016-03-23\n\tBLOCKED\n2026-09-19, 2026-09-21 · raw HTML\n\tsteam.kobal.cc\tCLEAN\n2026-09-19, 2026-09-21 · raw HTML\n\t2017-01-07\nkobal.cc, RDAP\n\tLive browser capture + supplied OpenID URL\tfarmskins.com.json\nCobaltLab\ncobaltlab.tech\n\tBLOCKED\n2026-09-21 · raw HTML\n\tcobaltauth.com\tCLEAN\n2026-09-21 · raw HTML\n\t2025-01-07\nRDAP\n\tSupplied OpenID URL\tcobaltlab.tech.json\nCSGO.NET\ncsgo.net · reg. 2012-07-22\n\tBLOCKED\n2026-09-21 · raw HTML\n\tcn2.easylot.net\tCLEAN\n2026-09-21 · raw HTML\n\t2016-09-03\neasylot.net, RDAP\n\tLive browser capture\tcsgo.net.json\nGGDrop\nggdrop.com\n\tBLOCKED\n2026-09-21 · raw HTML\n\tggauth.com\tCLEAN\n2026-09-21 · raw HTML\n\t2023-05-03\nRDAP\n\tSupplied OpenID URL\tggdrop.com.json\nRustChance\nrustchance.com\n\tBLOCKED\n2026-09-21 · raw HTML\n\thgfuihd.com\tCLEAN\n2026-09-21 · raw HTML\n\t2019-01-27\nRDAP\n\tSupplied OpenID URL\trustchance.com.json\nSkin.Fans\nskin.fans\n\tBLOCKED\n2026-09-21 · raw HTML\n\tauth.skinfans.com\tCLEAN\n2026-09-21 · raw HTML\n\t2018-07-16\nskinfans.com, RDAP\n\tSupplied OpenID URL\tskin.fans.json\nSkinport\nskinport.com · reg. 2018-09-05\n\tBLOCKED\n2026-09-21 · raw HTML\n\tskinport.app\tCLEAN\n2026-09-21 · raw HTML\n\t2020-06-20\nRDAP\n\tLive browser capture + supplied OpenID URL\tskinport.com.json\nSkins.Cash\nskins.cash\n\tBLOCKED\n2026-09-21 · raw HTML\n\tskinscash.live\tCLEAN\n2026-09-21 · raw HTML\n\t2019-12-05\nRDAP\n\tSupplied OpenID URL\tskins.cash.json\nTF2Hunt\ntf2hunt.com · reg. 2018-01-13\n\tBLOCKED\n2026-09-21 · raw HTML\n\trstspcl.com\tCLEAN\n2026-09-21 · raw HTML\n\t2020-08-08\nRDAP\n\tLive browser capture + supplied OpenID URL\ttf2hunt.com.json\nCSGOGem\ncsgogem.com · reg. 2016-10-16\n\tBLOCKED\n2026-09-22 · raw HTML\n\tapi.csgem.com\ncsgem.com — separate registrable domain\n\tCLEAN\n2026-09-22 · raw HTML\n\t2014-03-08\ncsgem.com, RDAP — oldest in register\n\tManual collection + Link Filter capture\tlinkfilter-2026-09-22.json\nGamdom\ngamdom.com · reg. 2016-07-29\n\tBLOCKED\n2026-09-22 · raw HTML\n\tlogin.gambldom.com\ngambldom.com — one letter off the brand\n\tCLEAN\n2026-09-22 · raw HTML\n\t2017-09-24\ngambldom.com, RDAP\n\tManual collection + Link Filter capture\tlinkfilter-2026-09-22.json\n12CS\n12cs.fail · reg. 2026-03-24\n\tBLOCKED\n2026-09-22 · raw HTML\n\tfail.games\tCLEAN\n2026-09-22 · raw HTML\n\t2021-08-24\nfail.games, RDAP\n\tManual collection + Link Filter capture\tlinkfilter-2026-09-22.json\nCSGOEmpire\ncsgoempire.com · reg. 2015-06-10\n\tCLEAN\n2026-09-19, 2026-09-21 · Wayback 2026-09-21\n\tcsgoempirelogin4.com\none of ten numbered domains login1–10\n\tCLEAN\n2026-09-21 · Wayback 2026-09-21\n\t2020-07-20\n05:49:17Z, Verisign RDAP\n\tLive browser capture\tcsgoempire.com.json\nCS.MONEY\ncs.money\n\tCLEAN\n2026-09-21 · raw HTML\n\tauth.dota.trade\tCLEAN\n2026-09-21 · raw HTML\n\t2016-07-15\ndota.trade, RDAP\n\tSteam login-page notice\tcs.money.json\nCSFloat\ncsfloat.com · reg. 2021-07-11\n\tCLEAN\n2026-09-21 · raw HTML\n\tcsgofloat.com\noperator's former brand domain; separate registrable domain, not an evasion indicator\n\tCLEAN\n2026-09-21 · raw HTML\n\t2015-09-29\nRDAP\n\tLive browser capture\tcsfloat.com.json\nG4Skins\ng4skins.com\n\tCLEAN\n2026-09-21 · raw HTML\n\tauth.g4s.to\tCLEAN\n2026-09-21 · raw HTML\n\t2021-05-30\ng4s.to, RDAP\n\tSupplied OpenID URL\tg4skins.com.json\nJuice.GG\njuice.gg\n\tCLEAN\n2026-09-21 · raw HTML\n\tletmeinjuice.com\tCLEAN\n2026-09-21 · raw HTML\n\t2024-04-15\nRDAP\n\tSupplied OpenID URL\tjuice.gg.json\nMarket.CSGO\nmarket.csgo.com\n\tCLEAN\n2026-09-21 · raw HTML\n\tdota2.net\tCLEAN\n2026-09-21 · raw HTML\n\t2011-10-29\nRDAP\n\tLive browser capture + supplied OpenID URL\tmarket.csgo.com.json\nRust.TM\nrust.tm\n\tCLEAN\n2026-09-21 · raw HTML\n\tdota2.net\tCLEAN\n2026-09-21 · raw HTML\n\t2011-10-29\nRDAP\n\tSupplied OpenID URL\trust.tm.json\nCSGOLounge\ncsgolounge.com · reg. 2013-08-14\n\tCLEAN\n2026-09-22 · raw HTML\n\tdota2.net\nthird front-end on this auth host\n\tCLEAN\n2026-09-22 · raw HTML\n\t2011-10-29\ndota2.net, RDAP\n\tManual collection + Link Filter capture\tlinkfilter-2026-09-22.json\nDota2Lounge\ndota2lounge.com · reg. 2012-08-10\n\tCLEAN\n2026-09-22 · raw HTML\n\tdota2.net\nfourth front-end on this auth host\n\tCLEAN\n2026-09-22 · raw HTML\n\t2011-10-29\ndota2.net, RDAP\n\tManual collection + Link Filter capture\tlinkfilter-2026-09-22.json\nSkinBaron\nskinbaron.de\n\tCLEAN\n2026-09-21 · raw HTML\n\tskinbaron.com\nsame brand, different TLD\n\tCLEAN\n2026-09-21 · raw HTML\n\t2015-12-22\nRDAP\n\tSupplied OpenID URL\tskinbaron.de.json\nTF2Royal\ntf2royal.com · reg. 2022-08-17\n\tCLEAN\n2026-09-21 · raw HTML\n\ttf2auth.com\tCLEAN\n2026-09-21 · raw HTML\n\t2021-07-27\nRDAP\n\tLive browser capture + supplied OpenID URL\ttf2royal.com.json\nTradeit\ntradeit.gg\n\tCLEAN\n2026-09-21 · raw HTML\n\tconnect-tradeit.com\tCLEAN\n2026-09-21 · raw HTML\n\t2022-02-23\nRDAP\n\tSupplied OpenID URL\ttradeit.gg.json\nUpgrader\nupgrader.pro\n\tCLEAN\n2026-09-21 · raw HTML\n\tupgauth.space\tCLEAN\n2026-09-21 · raw HTML\n\t2026-08-14\nRDAP\n\tSupplied OpenID URL\tupgrader.pro.json\nSource: steamcommunity.com/linkfilter, unauthenticated GET, 2026-09-21, 53 hosts, 3 s spacing; steam_tos_assets/linkfilter-recheck-2026-09-21.json; raw HTML in steam_tos_assets/linkfilter-raw/. Registration dates: RDAP, steam_tos_assets/domain-registration.json. · Earlier check of 2026-09-19 in linkfilter-all-results.json · route records in auth-route-audit.json · Wayback Machine snapshots of the Link Filter pages, 2026-09-21, listed in wayback-snapshots.json (no snapshot exists for rbsnin.com; the local raw file is the only record).\n\nRegistration dates: RDAP (steam_tos_assets/domain-registry/). \"Supplied OpenID URL\" establishes the request parameters, not a completed login. No login was completed by the authors on any platform. A separate domain is not by itself proof of evasion. Nor is \"0 auth hosts blocked\" an independent finding: blocking one would break that platform's Steam login, so a register assembled from working logins cannot contain a blocked auth host. The observation that carries weight is the pairing and its duration — a main domain on the Link Filter beside a login domain that has run for years. This table carries 30 rows: 25 of the 27 routes with a per-route evidence file, plus five added on 2026-09-22 whose Link Filter split is captured in linkfilter-2026-09-22.json even though the realm itself was hand-collected — their rows say so in the source column. The two evidence-file routes not shown are skinsnipe.com (auth host pricing.tradeupspy.com, registered 2020-03-11) and csgobig.com (auth host letmeinbig.com, registered 2023-01-20); both returned BLOCKED main / CLEAN auth host in the check of 2026-09-22, recorded with SHA-256 in linkfilter-2026-09-22c.json, but the raw HTML for that batch is not in the published set, so they are named here rather than given a row that every other line in this table can evidence. The remaining 12 hand-collected routes in the register are identified as such in master_registry.json under realm_src: user.\n\nPrimary Empirical Audit · Multi-Year Date Range\nThe Big Picture Trap: Link Filter is Compliance Theater, Not a Shield\n\nOn desktop browsers, users are shielded by external defenses: Google Safe Browsing and Microsoft SmartScreen intercept known phishing with full-screen red warnings. Inside Steam's Big Picture mode, the in-game overlay (Shift+Tab), and the Steam Deck (SteamOS), those defenses do not exist. The embedded browser supports zero extensions, disables external Safe Browsing engines, and leaves the user with exactly one defensive barrier: Valve's linkfilter interstitial.\n\nSwipe to compare all four results →\n\n92.5%\n2025–2026 modern edge phishing passed clean (37/40)\n77.5%\n2023–2024 CS2 era phishing passed clean (31/40)\n70.0%\n2021–2022 legacy phishing passed clean (28/40)\n7 / 7\ngambling mains blocked (positive control)\nMulti-Year Longitudinal Audit: 120 Pure Steam Phishing Domains Tested Live (24 Sep 2026)\n\nTo test whether Valve's filter is simply slow to ingest new threats or fundamentally blind to them, we audited 120 confirmed Steam-specific phishing domains across three historical cohorts against steamcommunity.com/linkfilter:\n\nCohort 1: 2021–2022 (Classic Trade-Offer & Item Drops) — 70.0% Clean Pass (28/40). Even 4 to 5 years after being cataloged by community watchdogs, 7 out of 10 legacy phishing hosts still open without any block.\nCohort 2: 2023–2024 (CS2 Beta Hype & Fake Support Appeals) — 77.5% Clean Pass (31/40). Campaigns impersonating Counter-Strike 2 releases and fake community appeals (e.g. cs2-steam.com, appealsteamcommunity.help) pass straight through.\nCohort 3: 2025–2026 (Serverless Edge Deploys & Favicon Clones) — 92.5% Clean Pass (37/40). Modern phishing kits deploying on EdgeOne, Vercel, and Cloudflare Pages (e.g. steamgifter.online, steam-dp4lt5b8fnez.edgeone.dev) pass virtually unobstructed.\n\nTelemetry & Liability Shield, Not Protection. Why does the Link Filter exist if it passes 70% to 92.5% of pure Steam phishing? It functions as a corporate liability disclaimer and an outbound click telemetry sensor. By presenting a polite \"You are leaving Steam\" notice with a clickable green proceed button, Valve shifts legal blame onto the victim under the Steam Subscriber Agreement (*\"the user voluntarily navigated outside Steam\"*). Valve collects the telemetry of the click, but does not block the theft.\n\nThe Favicon Hash Proof: Zero Ingestion of Threat Feeds. Independent threat intelligence platforms (urlscan.io, Shodan, Censys) identify live Steam phishing kits using a simple search for Steam's official favicon hash (page.favicon.hash:9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad NOT domain:*.steampowered.com). This basic automated check surfaces active phishing clusters in seconds. Valve does not sync with external feeds, does not run hash-based threat hunting, and only manually intervenes when compelled by regulators (the 2016 WSGC gambling order) or to protect its trademarked domain strings.\n\nPrimary audit evidence artifacts: Longitudinal 120-domain multi-year audit: longitudinal-steam-phishing-audit.json · 100 dedicated Steam phishing sample: linkfilter-steam-phishing-100.json · Broad feed audit (n=250): linkfilter-coverage-2026-09-22.json.\n\nCSGOEmpire — batch registration of ten numbered auth domains\n\nOn 2020-07-20 ten numbered domains, csgoempirelogin1.com through csgoempirelogin10.com, were registered. Verisign RDAP timestamps are on file for all ten: login1 05:49:06Z, login5 05:49:08Z, login2 05:49:11Z, login3 05:49:14Z, login4 05:49:17Z, login6 05:49:20Z, login7 05:49:23Z, login8 05:49:26Z, login9 05:49:28Z — nine domains in 22 seconds — and login10 at 05:56:03Z, seven minutes later. The spacing is consistent with a single registrar bulk operation.\n\nThe pattern is consistent with pre-provisioned fallback hosts; only login4 has been observed in a live OpenID request. csgoempire.com and csgoempirelogin4.com both returned CLEAN in the Link Filter on 2026-09-21; CSGOEmpire was not among the sites named in press reports of the July 2016 notices.\n\n# DNS — all 10 active (September 2026)\nOK csgoempirelogin1.com 172.67.129.43\nOK csgoempirelogin2.com 172.67.175.168\nOK csgoempirelogin3.com 188.114.96.3\nOK csgoempirelogin4.com 188.114.96.11 ← in OpenID traffic\nOK csgoempirelogin5.com 172.67.160.194\nOK csgoempirelogin6–10.com Cloudflare IPs\nNXDOMAIN: csgoempirelogin11.com\nAll 10 registered 2020-07-20; all 10 RDAP-timestamped (steam_tos_assets/domain-registry/csgoempireloginN.com.rdap.json)\nConclusion for regulators\nA blocked main domain paired with an unblocked auth host leaves the login route open — and it stays open for years.\n\nThe Link Filter block on the main domain is a verifiable, public record. The auth host carries the \"Sign in with Steam\" traffic and appears in Valve's own OpenID request parameters. Across checks on 2026-09-21 and 2026-09-22, in 26 filter-split pairs the main domain returned a Link Filter block while the proxy carrying its login returned none. The register above measures the other half of that: these hosts are not short-lived burner domains. Several had been registered for more than a decade at the date of the check, and every one of those days is a day on which Valve received the hostname in its own request parameters. Valve has published no per-operator enforcement record, so whether any other measure was applied to these hosts cannot be established from public data.\n\n12 yr 6 mo\ncsgogem.com is blocked in the Link Filter.\nIts login host api.csgem.com has been\nregistered since 2014-03-08 and is not.\nPlain Language Summary — For Regulators & Courts (expand)\nPlain language summary — for regulators\nBackground: What Steam Is and Why It Matters Here\n\nSteam is a software platform operated by Valve Corporation (Bellevue, Washington, USA). Steam functions as a digital identity provider: gambling and gaming websites across the internet use a system called \"Sign in with Steam\" — a button that allows a website to verify that a visitor has a real Steam account. This is similar to \"Sign in with Google\" or a government-issued identity card check: the website sends the user to Steam's servers, Steam confirms who they are, and Steam sends them back to the website. Valve operates the authentication system. Every single login through \"Sign in with Steam\" passes through Valve's own servers.\n\nWhat Valve Did: The Domain Block\n\nIn July 2016, following media and legal pressure over skin gambling, Valve's counsel sent notices to approximately 23 named gambling sites (per press reports of 21 July 2016); in October 2016 Valve told the Washington State Gambling Commission it had contacted more than forty sites. Some gambling domains appear in the Steam Link Filter — a list that makes any link to them posted inside Steam (in chat, on a profile page, in the store) show a warning page: \"Link Blocked!\" The Link Filter is the only enforcement measure whose effect can be observed from outside Valve.\n\nExample: A link to rollbit.com inside Steam produces the Link Filter warning page (checked 2026-09-19 and 2026-09-21). On paper, the gambling site is blocked.\nWhat a Proxy Domain Is\n\nA separate-domain auth host is an authentication proxy: a second website address, on a different registrable domain, that the same operator puts between its users and Steam for the sole purpose of carrying the \"Sign in with Steam\" step. It proxies the login. The user believes they are signing in to the platform; the request that reaches Valve carries the proxy's hostname, not the platform's. It usually has no publicly visible connection to the gambling site, and it is the address that receives users back after Steam confirms their identity.\n\nExample: Rollbit operates under rollbit.com, which the Link Filter blocks. For Steam authentication, the flow observed on 2026-09-20 used a separate address: rbsnin.com, registered 2026-09-18. This address returned no Link Filter block on 2026-09-21. The gambling site continued to operate, and its Steam login flow ran through the unblocked host.\nThe Critical Point: The Auth Host Is Sent to Steam in Every Request\n\nValve does not need to scan or crawl to learn which auth hosts are in use. Steam is the OpenID identity provider for these sites, and every \"Sign in with Steam\" click sends a GET request to Valve's own servers containing the auth hostname in plaintext. Under OpenID 2.0 §9.1 the return_to field is formally optional, but without it Steam cannot deliver the login result, so for a working Steam login it is effectively required. Steam itself renders the hostname on the login page (\"<host> is not affiliated with Steam or Valve\").\n\n— Shape of the request Steam receives (host as observed for Rollbit on 2026-09-20): —\nGET steamcommunity.com/openid/login\n&openid.mode=checkid_setup\n&openid.return_to=https://rbsnin.com/… ← effectively required; arrives in Valve's log\n&openid.realm=https://rbsnin.com ← self-declared by the site; rendered on Steam's login page\nIf the site uses server-to-server verification (check_authentication), Valve's log also records the platform's server IP and hosting network.\n\nExtracting the hostname from this request is a standard operation. The enforcement record — which hosts were acted on, which were not, and under what criteria — exists only in Valve's infrastructure and has not been published.\n\nWhat This Proves\n\n1. The Link Filter block acts on links, not on logins. Blocking the main domain (for example rollbit.com) shows a warning to users who click links to it inside Steam. It does not stop the site from operating, or from using Valve's own OpenID service through a different address.\n\n2. The auth hosts tested were not blocked. The table above shows separate-domain auth hosts registered between 2011 and September 2026, several of them years after the July 2016 notices. In 26 pairs the main domain returned a Link Filter block and the proxy carrying its login did not (unauthenticated checks, 2026-09-21 and 2026-09-22; raw responses and SHA-256 saved). That proxy would stop working the day Valve refused it, which is why the measure here is how long it has run, not whether it is listed. Valve receives these hostnames in its own OpenID requests. Whether any measure other than the Link Filter was applied cannot be determined from public data, because Valve has published no per-operator enforcement record.\n\n3. The sites continued to authenticate through Valve's infrastructure. \"Sign in with Steam\" is Valve's service; every authentication through it is a request Valve receives and processes. Valve also earns revenue from case keys, and the Steam Community Market charges a combined fee of about 15% on transactions completed inside the Market (not on external trades). The Link Filter action created a public record; it did not interrupt the authentication relationship.\n\nWould Blocking Have Worked?\n\nBy analogy: when the free domain registrar Freenom wound down in 2023, phishing campaigns that depended on its domains were disrupted. Operational continuity depends on infrastructure stability.\n\nThe same logic applies here. If an auth host were refused in Steam's OpenID processing, the platform's \"Sign in with Steam\" function would break until a new host is registered, certificates issued and DNS propagated. During that window: downtime.\n\nRotation does not make blocking futile. It makes blocking an operational cost. Since new hosts appear in Valve's own request logs on first use, a response could run at the speed of that first use.\n\nBatch registration is itself a signal: CSGOEmpire's login1–login10 were registered on 2020-07-20, nine of them within 22 seconds (Verisign RDAP). A response does not need to be domain-by-domain; a sequential series from one registrar session can be identified as a series.\n\nThe public record does not show an attempt to block auth hosts that was defeated by rotation.\nIt shows main domains blocked while the proxy carrying each login kept running — 26 pairs as of 2026-09-22, the oldest auth host registered 12 years 6 months — and no published enforcement record for any operator.\nThe question for the regulator is therefore: what enforcement, if any, has Valve applied to the auth hosts it receives in its own OpenID requests?\nWhat Valve Did — and Why It Did Not Interrupt the Auth Path\n\nThe table below maps each publicly documented Valve action against whether it affected the OpenID authentication entry point. The finding is not \"Valve did nothing\" — it is that none of the publicly documented actions touched the point where gambling-platform logins pass through Valve's servers.\n\nDate\tValve Action\tAffected openid.return_to path?\nJuly 2016\tPublic statement of 13 July 2016; counsel's notices to ~23 named sites (press, 21 July 2016); >40 sites contacted per Valve's October 2016 letter to WSGC\tNo. Notices and the Link Filter act on operators and links; the OpenID request path was not changed.\n2017\tClosure of IEconItems_730/GetPlayerItems (according to CSFloat's engineering account; no Valve changelog located)\tNo. Affected public item-history visibility. OpenID authentication was not modified.\n2018-03-29\tCS:GO 7-day trade lock announced (blog.counter-strike.net)\tNo. Slowed item movement; the OpenID request path was not changed.\n2022-05-10\tTrade-cancellation endpoints removed from the public Web API (user-detected; no Valve changelog — node-steam-tradeoffer-manager #325)\tNo. Closed the offer-swap tooling; OpenID authentication was not modified.\n2023-12-04\tAPI-key creation now requires mobile confirmation (steamcommunity.com/dev/apikey; no changelog)\tNo. Protected the key endpoint; the auth hosts documented here were not affected.\n2026-09-19 / 09-21\tSteam Link Filter state as observed by the authors\tNo. 14 main domains returned a block in the saved 2026-09-21 recheck — 26 split pairs in the register by 2026-09-22 — while the proxy carrying each login kept running.\nSources: Valve statement of 13 July 2016 (store.steampowered.com/oldnews/22883, archived 2026-09-21) · CSFloat engineering account of the 2017 closure (blog.csfloat.com, archived 2026-09-21) · Link Filter state: linkfilter-recheck-2026-09-21.json.\nThis finding is falsifiable by a single published instance in which Valve refused an OpenID request because openid.return_to pointed to a gambling auth host. No such instance has been located in the public record.\nThe two most recent auth-host registrations\nhowl.unowas registered 2026-08-11 (RDAP), 41 days before 2026-09-21; howl.gg returned a Link Filter block on 2026-09-18, 2026-09-19 and 2026-09-21. Whether the block preceded the registration is not established.\nrbsnin.comwas registered 2026-09-18T09:34:52Z (Verisign RDAP) and was observed in Rollbit's Steam login flow on 2026-09-20 via Steam's own login-page notice; rollbit.com returned a Link Filter block on 2026-09-19 and 2026-09-21, rbsnin.com did not.\nEach host in the table above is sent to Valve's authentication servers as openid.realm on every login attempt.\nFull per-route data and Link Filter verdicts: the table in Section 3 above; raw results in linkfilter-recheck-2026-09-21.json and linkfilter-all-results.json.\nMethodology — How the Route and Link Filter Counts Were Established\n1. Domain resolution\nThe 2026-09-21 audit resolved 78 of 189 requested platforms: 33 authenticate on their own hostname and 20 on their own subdomain — direct authentication, and none of them are counted as separate-domain routes. The remaining 25 authenticate through a separate registrable domain, across 24 distinct hostnames (dota2.net is shared by market.csgo.com and rust.tm): 10 established by live browser capture, 3 by Steam's own login-page notice, 12 by a supplied OpenID URL. The live register (master_registry.json, 2026-09-22) extends that to 44 separate-domain routes: 26 filter-split pairs (main domain BLOCKED, auth host CLEAN) plus 18 further routes without a main-domain split. Of the 44, 27 carry a per-route evidence file; the other 17 were collected by hand and are marked realm_src: user in the register. Five of those seventeen — csgogem.com, gamdom.com, 12cs.fail, csgolounge.com and dota2lounge.com — were added on 2026-09-22 with a Link Filter capture of both hosts (raw HTML + SHA-256 in linkfilter-2026-09-22.json), so the split itself is evidenced even though the realm is hand-collected; they appear in the table above alongside the evidence-file routes. tfauth.com (tf2easy.com) was dropped from the register on 2026-09-22: like arena.fragnet.net, nothing verifiable links it to its origin site. The count is re-derivable from the published auth-route-audit.json (run of 2026-09-21) by one rule: a platform counts only when its observed Steam OpenID host sits on a different registrable domain than the platform itself.\n2. Steam Link Filter status\nTested via steamcommunity.com/linkfilter/?url=https://[domain], unauthenticated, on 2026-09-19 and 2026-09-21; raw HTML saved with SHA-256. Status recorded for main domain and auth host separately. A classifier distinguishes the generic \"You are leaving Steam\" notice (CLEAN) from the \"Link Blocked! ... flagged as potentially malicious\" page (BLOCKED); a google.com control confirms the two are not conflated. An earlier authenticated variant of this test was discarded after it returned \"blocked\" for every domain including that control — traced to an invalid session cookie in the probe script, not a real result.\n3. Observation of the auth host\nLive capture: a Playwright browser navigated to each platform's login flow and the openid.return_to hostname was read from the intercepted request. Login-page notice: the hostname was read from Steam's own \"<host> is not affiliated with Steam or Valve\" text, which Steam renders from openid.realm (rbsnin.com, sc-auth.net, auth.dota.trade). Supplied URL: a Steam loginform URL provided to the authors; this establishes the request parameters, not a completed login. No login was completed on any platform.\n4. Coverage — what was not resolved, and why that matters\nOf the 189 platforms, 110 produced no established route and one was not applicable (189 − 78 − 1). This dossier counts none of them. The breakdown of the 110, from the audit file: 22 bot challenges, 14 timeouts, 12 HTTP errors and 10 navigation errors — the observer could not reach the login flow, though most of these sites open normally in an ordinary browser; 20 showed no Steam login control on the landing page; 16 reached a login flow that could not be resolved to a host; 11 domains did not resolve in DNS; 5 stopped at a consent wall. The register below splits the same 110 differently: the 11 that did not resolve in DNS are listed separately as Removed · NXDOMAIN, and the one not-applicable entry joins the rest. 189 platforms audited, 11 removed on a definitive NXDOMAIN from both resolvers, 178 retained (platform-audit.json, platforms-removed.json). 137 auth domains that the ledger had guessed by naming pattern were deleted from the data on 2026-09-19 — never observed, therefore never evidence. Three of the guesses were contradicted by supplied OpenID URLs: buff.163.com, gamerpay.gg and csgoluck.com authenticate directly, against guesses of buffauthproxy.163.com, gamerpayredirect.io and lucklogin.app. The removals are listed in the published audit file.\nThe 25 is a floor, not a ceiling. Among the 78 platforms that did resolve, 25 used a separate domain and 53 did not. Nothing about the unresolved 110 is assumed from that ratio, and no projection from it appears anywhere in this dossier. Each one is resolvable by a person opening the site and pressing \"Sign in with Steam\": the auth hostname is in the URL of the Steam page that loads.\nThe point of this section: an independent observer needs a browser and a lot of patience to resolve 189 platforms, and got 78. Valve needs a database query. Every platform that uses \"Sign in with Steam\" — resolved and unresolved alike — sends openid.realm to Valve's authentication endpoint on every login. The gap in this table exists because the authors are outside the system. It does not exist for Valve.\nObserved proxy hostnames are in auth-route-audit.json. Domain registration dates from RDAP (Verisign) / IP2WHOIS. Link Filter results in linkfilter-all-results.json.\nAnalogy for clarity\n\nImagine a licensed taxi company is told by regulators that it may no longer operate from its registered Main Street address. The company removes the sign from Main Street. That sign removal is documented. However, the same company opens a Side Street address — registered under a different name — and continues operating from there. The regulators operate the central dispatch system that every taxi from both addresses uses. Every ride request shows \"pick up from Side Street.\" The regulators never revoke the Side Street licence. The removal of the Main Street sign is the only enforcement that occurred. The taxi company never stopped operating.\n\nPart A — Technical record · Section 3.1\nInside Steam, Valve's list is the only list.\n\nA link clicked in the Steam client, the in-game overlay or Big Picture mode does not open in the user's browser. It renders inside Steam's own embedded browser — where the warning layers a browser would apply are not present. The Link Filter is not one safeguard among several. It is the whole of it.\n\nIn a normal browserThree independent layers\nGoogle Safe BrowsingA full-page interstitial for hosts on Google's phishing and malware lists, updated continuously and independent of the site being visited.\nThe antivirus browser extensionMost consumer endpoint products ship a browser add-on that checks the destination against the vendor's own reputation list.\nEndpoint HTTPS inspectionWhere the product performs TLS inspection, page content is scanned before it reaches the user.\nIn the Steam client, overlay and Big PictureOne layer\nGoogle Safe BrowsingNot present. The check requires Google API keys that are not provisioned in embedded Chromium builds; where they are absent, Chromium's own design documentation records that the Safe Browsing handler is simply never added to the request chain.\nThe antivirus browser extensionNot present. Steam's renderer is not the user's browser and loads no extension from the user's browser profile, so no add-on runs against the page.\nEndpoint HTTPS inspectionProduct-dependent. The traffic terminates inside a code-signed Valve process rather than a recognised browser, and a number of endpoint products exempt signed applications from TLS inspection.\nThe Steam Link FilterValve's own blocklist, consulted when a link leaves the Steam ecosystem. This is the sole check that runs — and the table above records what it returns for the auth hosts documented in this section.\nA test any reader can run, and the finding falls if it fails\n\nOpen one of Google's published Safe Browsing test URLs (testsafebrowsing.appspot.com) in Chrome: a full-page red interstitial appears. Open the same URL from a Steam chat message, so that it renders in the Steam client or the overlay: no interstitial appears. The only warning Steam can produce is its own Link Filter page, and only for hosts on Valve's list.\n\nValve's own bug-bounty recordThe one layer has been got around before — on Valve's own record\n\nIf the Link Filter is the only check that runs inside the client, its own failure modes are not a side issue. Two reports on Valve's HackerOne programme, both accepted, both resolved, both since disclosed in full:\n\n#291750archived 2025-11-16 ↗Open Redirect · medium\nLink filter protection bypass\n\nReported 19 November 2017, resolved, disclosed 9 May 2018. The report's own proof of concept: substituting the ideographic full stop 。 (%E3%80%82) for the dot in a hostname — it is possible to bypass the blocking. The interstitial this section is about did not appear.\n\n#1079561archived 2026-09-24 ↗Information Disclosure · high\nBig Picture web browser leaks login cookies and discloses sensitive information (may lead to account takeover)\n\nReported 15 January 2021, resolved, disclosed 21 September 2021. Valve's own severity rating is high, and the title states the consequence. The disclosed record carries the title, rating and dates; the technical write-up is not in the published payload, so nothing further is quoted from it here.\n\nThe authors' reading, not a finding of either report: the two sit on either side of the same gate. One is the warning failing to appear before the destination opens; the other is the session leaving the client once a page is open inside it. The sequence that follows a stolen session — key registered without a prompt, the real trade cancelled, a duplicate sent to a clone — is the pattern set out in Section 5 to Section 8. Both reports are closed; neither is offered as a live vulnerability. What they establish is narrower and enough: the single remaining layer has a documented history of being got around, on Valve's own record.\n\nSource: the HackerOne disclosure record for each report, retrieved 2026-09-22 — number, title, team, weakness, severity, report and disclosure dates and state as published by HackerOne. Retrieval record: hackerone-reports.json. No bounty figure is stated here; none appears in the disclosed record retrieved.\n\nField observation · PhishDestroyDetections that normally end a campaign did not end these\n\nWe watched phishing hosts keep pulling traffic while carrying 20 or more vendor detections. Delivered by web or email, a campaign in that state dies in days — the browser and the antivirus both act on those verdicts. Inside Steam neither does. The verdicts existed the whole time. Nothing in the client ever asked.\n\nWhat this means for a minor with an antivirus installed\n\nHe ignores no warning and disables nothing. A message arrives inside Steam — a free knife, a vote for a friend's team — and the page opens inside Steam. He never opens a browser, so the browser never protects him. His antivirus is running and may already rate that domain malicious; it is never asked. Every warning that could have stopped him already exists. None of it reaches him. He believes he never left Steam, and he did not.\n\nThe giveaway is not the phisher's invention — free Valve items are how the skin and gambling sites advertise, which is exactly why the message reads as ordinary. Complaints: the enforcement archive. Age and children's data: Section 17.\n\nSources: Steam renders web content through the Chromium Embedded Framework in the steamwebhelper process — see DARKNAVY's technical analysis of 27 June 2024 ↗ and Valve's own Steam Client Beta forum ↗ archived 2025-08-04 ↗. No CEF version is relied on: embedded Chromium is not Chrome and ships none of Chrome's Google services. Safe Browsing without API keys: Chromium design document ↗ archived 2026-08-21 ↗, Chromium API keys ↗ archived 2026-08-30 ↗ (“Many of the Google APIs used by Chrome are specific to Google and not intended for use in derived products”), and the same effect in other unkeyed builds — Homebrew cask #193814 ↗. Test URLs: testsafebrowsing.appspot.com ↗.\n\nTwo different clocks\nThe domain’s age.The observation’s date.\n\nA registry creation date establishes when a domain was registered. A dated OpenID record establishes the return host in that record. The former cannot fill the years before the latter.\n\nThe complete register distinguishes a separate registrable domain, a site’s own subdomain and a direct route. Each row links to its source and DNS result.\n\nInspect the domain register →· Download registry dates ↗· Reproduce the observation ↗\n\nPart A — Technical record · Section 4\nAn endpoint closed. Public tracing lost a key.\nContext & source limits\n\nSteam shipped changes that removed public visibility of item Asset IDs and restricted API inventory access. The effect: tracing a specific item by its original Asset ID became impossible from public data. What follows is what was possible before, what stopped being possible after, and what that costs a victim trying to prove where their property went. The date is 2017 according to CSFloat's engineering account; no Valve changelog has been located. The sequence — roughly a year after the July 2016 gambling statement — is the investigative question, not a finding. The item records themselves remain inside Valve's systems; outside investigators lost access to the original-ID chain, while float, seed and paint identifiers allow only partial matching.\n\nThe rule Valve applies: Steam Support does not restore items that left your account, and the burden of showing what happened is yours. The record: in 2017 Valve closed the endpoint that carried original item IDs. Before it, anyone could follow a stolen skin from the victim's account into a marketplace bot. After it, nobody outside Valve can. The proof the victim is asked for is the proof that was switched off — and it still exists, inside Valve.\n\nThe Pre-Blackout Era\n\nHistorically, every virtual item generated on Steam possessed a globally unique, immutable Asset ID. Third-party OSINT databases could index these IDs. If a user had an item hijacked, investigators could trace the lineage of that specific asset as it moved from the hijacker's intermediate account into the storage accounts of a marketplace or gambling site.\n\nBEFORE: an item could be followed from the victim's account through intermediate accounts and into a marketplace or casino storage bot, by anyone, using public data.\nAfter the change\n\nAccording to CSFloat's engineering account, Valve closed the endpoint in 2017 and original item IDs stopped being available to outside parties. No Valve statement of the reason for the change has been located. In the same period, no published action against the commercial bot accounts that moved items at scale has been located either.\n\nWhatever the reason for it, the change severed the public chain of custody. A victim can no longer reproduce the original-ID chain from public data to show that a specific stolen item was liquidated through a specific marketplace or casino. The item records still exist inside Valve's systems; the public, researchers and law enforcement working from public data cannot reach them.\n\nAFTER: tracing a specific item by its original Asset ID is no longer possible from public data. The original-ID chain of custody for an item moved after 2017 exists only inside Valve's infrastructure; no such record has been produced publicly. Float, seed and paint identifiers allow only partial, probabilistic matching.\nIEconItems_730\nGET/IEconItems_730/GetPlayerItems/v1/\nTraceable Payload (Pre-Patch)\n\"id\": \"14892281934\",\n\"original_id\": \"11829910211\",\nStatus: Victim can track item lineage across bot accounts.\nObfuscated Payload (Post-Patch)\nCurrent\n\"id\": \"HIDDEN_BY_PRIVACY_SETTINGS\",\n\"original_id\": \"NULL\",\nStatus: outside parties can no longer trace item lineage by original Asset ID from public data.\nEffect on evidence: after the change, the public data needed to follow a specific item by its original Asset ID from a victim's account into a marketplace or casino bot was no longer available. The internal records still exist at Valve; a victim, researcher or investigator working from public data cannot reproduce the original-ID chain (float, seed and paint identifiers allow only partial matching).\n\nSource: CSFloat engineering account of the 2017 closure of IEconItems_730/GetPlayerItems — blog.csfloat.com/how-floatdb-tracks-items (archived 2026-09-21) · the payloads shown are an illustration of the field shape, not captured responses · no Valve changelog for the closure has been located.\n\nPart A — Technical record · Section 5\nOne session. More access than the user sees.\nContext & source limits\n\nValve's API-key architecture, as it stood before the 2023 changes, departed from baseline industry standards (OWASP ASVS, NIST SP 800-63B) and is the mechanism described in the automated inventory-theft complaints preserved in the evidence archive (Sections 6–8).\n\nThe rule Valve applied: the account holder created the key, accepted the terms, and bears the loss — that is the answer in the archived refusals. The record: until December 2023 a stolen session cookie alone could register that key. No password. No Steam Guard. No notification to the person whose account it was. The user did not create the key, could not see it, and was told he did. Mobile confirmation was added on 2023-12-04 — about seven years after the 2016 statement and roughly six after the scam panels the archive preserves. Those years were not paid by Valve. They were paid by the accounts emptied in the meantime, a share of them children's.\n\nOWASP ASVS 2.8 / NIST SP 800-63BSEVERITY: CRITICAL\n1. Insufficient Step-up Authentication\n\nSteam allowed the generation of highly privileged, long-lived API keys using only a session cookie. No 2FA (Steam Guard) or step-up authentication challenge was required when setting up or modifying a developer API key, so the Steam Guard mobile confirmation — the only second factor Steam offers — did not protect this step. (A hardware second factor was requested in Valve's own tracker in 2016 and the issue is still open: Appendix D, GH-01.)\n\nStatus: unpatched before 2023. Allowed a script holding a stolen cookie to register a key without any user interaction.\nOWASP A01:2021 / Least PrivilegeSEVERITY: CRITICAL\n2. Lack of Principle of Least Privilege\n\nThe Steam Web API lacked any role-based authorisation scopes. A developer API key issued for \"read-only\" inventory status possessed complete \"write\" permissions — including the ability to manipulate existing trades, initiate new ones, register webhooks and decline valid pending exchanges.\n\nStatus: systemic design defect. One key = full read/write control of the account's inventory and trades.\nOWASP A07:2021 / SessionsSEVERITY: HIGH\n3. Broken Session Management\n\nHijacked web sessions originating from server-hosting IP ranges were reported by users to persist. Standard practice is to terminate sessions on geographic anomalies and on password change; user reports collected in the archive describe sessions that remained active after a password change.\n\nStatus: reported behaviour (user complaints in the archive). Sessions could generate API keys without re-authentication.\nDomain-level blocking was technically feasibleENFORCEMENT FEASIBILITY\n4. Domain-Level Blocking of Auth Hosts Was Technically Feasible\n\nValve already operates a domain list (the Link Filter) and already receives every auth hostname in its own OpenID requests. The two mechanisms are not connected in any way visible from outside: as of 2026-09-22, in 26 pairs the main domain was on the filter while the proxy carrying its login was not.\n\nConnecting them is a small engineering task: read the openid.realm hostname from each incoming request, compare it against a list, and refuse or flag the request. The illustration on the right shows the shape of such a routine. Refusing the auth host — rather than only the public landing page — would interrupt the \"Sign in with Steam\" step that these platforms depend on.\n\nNo public evidence shows that Valve runs such a check. The Steam Community Market's combined fee of about 15% applies to sales completed inside the Market; it is not collected on these platforms' external trades.\n\nblock_auth_hosts.pyILLUSTRATION\n// Read the host Steam already receives — no scanning\ndef on_openid_request(request):\nhost = parse_openid_realm(request)\nif host in blocked_domains:\nrefuse(request)\nNote: pseudocode for illustration only. Both halves already exist at Valve — the auth hostname arrives in the request, and the domain list is the Link Filter. No public record explains why they are not connected.\nSection 5.1 — The standards were not unpublished\nValve builds against these rules every day. It did not build to them here.\n\nSteam ships on the App Store and Google Play, sells through the major card processors, and consumes third-party APIs like any other large platform. Each of those relationships carries a published, dated security requirement that Valve must satisfy to keep operating. Set the dates of those requirements against the dates on which Steam's own Web API acquired the same protections. Nothing below is a private standard, an internal memo or a trade secret: every row is a public document with a publication date.\n\nPublished external security requirements, with their dates, set against the date the Steam Web API acquired the equivalent control\nThe published standard, and the date it took effect\tThe Steam Web API on the same question\nScoped authorisationOAuth 2.0 — RFC 6749, October 2012. Section 3.3 defines scope so a client receives only the access it asks for. It has been the default of every major platform API since.\tGranular scopes arrived on 16 January 2026.Before that a single Steam Web API key carried full read and write over the account's trades regardless of why it was issued. Thirteen years and three months after the specification that defines the control.\nA key is not an authorisationGoogle's own Cloud documentation: A standard API key doesn't authenticate a principal, and for APIs that create or manage resources, don't use authorization keys in production.\tThe Steam Web API key was exactly that.A bearer string, issued to an account, sufficient on its own to read the inventory, cancel a pending trade and send a new one. No principal was authenticated at the point of use.\nMulti-factor authentication on privileged accessPCI DSS 3.2, requirement 8.3 — mandatory from 1 February 2018 for all non-console administrative and all remote access to the cardholder data environment. Apple then required two-factor authentication of every Developer Program account holder from 27 February 2019: developers with the Account Holder role in a developer program will need to enable two-factor authentication to sign in.\tA second factor was required to create an API key from 4 December 2023.Until then a stolen session cookie was enough, with no prompt on the account holder's phone and no notification afterwards. Four years and nine months after Apple made Valve itself use a second factor merely to sign in to a developer portal.\nCredential lifecycle and revocationTwitch requires of every third-party application: Your app must validate the OAuth token when it starts and on an hourly basis thereafter, and states that it audits for applications that do not. Its legacy v5 API was retired outright on 28 February 2022 on a published schedule.\tNo published key-lifecycle record.The 2023 change protected the creation endpoint. No Valve statement located with it addresses keys already registered, and no changelog accompanied the change at all. Whether keys created before it were invalidated cannot be established from public data — which is the question a data subject would need answered to know whether a key created on their account years earlier is still live.\nArchitectural Benchmark // Token Architecture\nGitHub Fine-Grained Scopes vs Valve Steam Web API\n\nValve developers manage open-source software on GitHub daily using granular least-privilege tokens. Compare that with the monolithic key issued to 130M Steam players.\n\nGitHub Fine-Grained Token\nUsed by Valve on GitHub\n\nFine-grained token with scoped isolation and mandatory lifecycle enforcement.\n\nRepository Access:Selected Repos only (1 repo)\nIssue Permissions:Read-only [✓]\nCode & Secrets:No access [✕]\nExpiration:30 Days (Mandatory TTL)\nAudit Logging:IP, User-Agent & Timestamp\nSecurity Posture: Least-privilege token limits damage to a single read-only resource.\n!Valve Steam Web API Key\nIssued to 130M Users\n\nSingle 32-character master string carrying all-or-nothing trade and inventory authority.\n\nAccount Access:FULL ACCOUNT (Monolithic)\nTrade Management:Read, Cancel, Decline [!]\nGranular Scopes:NONE (Arrived 2026, 13y late)\nExpiration:NEVER (Valid indefinitely)\nAudit Logging:NONE (Zero IP history for user)\nVulnerability: Stolen key allows silent interception of all outgoing trade offers.\nThe standard applied in one direction\n\nSuppose a vendor Valve depends on — a cloud provider, a payment processor, a CDN — left a credential endpoint without a second factor, and months later Valve's own corporate data left through a key minted at that endpoint. Would Valve accept that the fault lay with whoever clicked the link? The archived refusals preserved in this dossier answer the mirror-image question for the user: the position taken is that the account holder created the key and bears the loss. The same architecture is described as the vendor's failure in one direction and the user's responsibility in the other. Which it is, is not a technical question, and it is not one this investigation can settle — it is what a court or a supervisory authority decides.\n\nIllustration, not evidence — the standard read back the other way\nA payment processor that let a third-party script mint a full-privilege transaction credential from a browser cookie alone, with no prompt to the account holder.\nAn identity provider that closed the hole its tokens were minted through and published nothing about the tokens already minted.\nA bank that answered a disputed transfer by observing that the credential used was registered on the customer's own account, and closed the ticket.\n\nNone of these is offered as a finding about any named company. They are the same design decisions, moved to a setting where the supervisory response is well documented — which is the comparison a regulator is being asked to make.\n\nWhat the record establishes: the controls absent from the Steam Web API were public, dated and, in several cases, conditions Valve had to satisfy to keep shipping its own products. The interval between each standard and the equivalent Steam change is measurable and is set out above. What it does not establish is why. No Valve statement of reasons for any of these intervals has been located, and none is assumed here; that record exists inside Valve and has not been published.\n\nSources, each a public document: OAuth 2.0 — RFC 6749, October 2012 ↗ · Google Cloud — API keys documentation ↗ · PCI DSS 3.2 requirement 8.3 — PCI SSC resource guide ↗ · Apple — Upcoming Two-Factor Authentication Requirement for Account Holders, 20 February 2019 ↗ archived 2025-05-06 ↗ · Twitch — token validation requirement ↗ and the v5 shutdown notice ↗ archived 2025-01-27 ↗. Steam's own dates are those in the update record in this section; the 2023 and 2026 entries are the ones Valve shipped without a changelog. Retrieved 2026-09-22.\n\nValve's own update record — dated, from public sources\nDate\tValve change\tAnnounced?\tWhat it closed\tLag: mechanism public → fix\tSource\n2026-09-01\tAutomated Suspicious Chat Flagging\tYes\tDangerous links / patterns in group chats\t—\tnews ↗\n2026-01-16\tSteamworks Web API granular scopes\tYes\tLeast-privilege scopes for developer keys\t—\tannouncement ↗\n2025-07-15\tCS2 Trade Protection & reversal window\tYes\tNothing. Not a root-cause security fix. Support-side account recovery access remains untouched. Triggering reversal inflicts an automatic 30-day trade lockout (Skinvault ↗), while cash-trading shock caused a $104M (-25%) 24h market cap plunge (CSMarketCap ↗). In 2026, timers became per-item (Skin.land ↗).\t—\tFAQ ↗\n2025-05-14\tAccount Security Announcement\tYes\tStealer / session-hijack guidance\t—\tannouncement ↗\n2024-10-02\tCS2 'The Armory' 7-day hold\tYes\tHold on trade/market for Armory items\t—\tannouncement ↗\n2024-09-18\tNew-device login trade restriction\tYes\t2–7 day trade lock on new devices\t—\tFAQ ↗\n2024-02-14\tProfile name & avatar change hold\tYes\t2–4 h cooldown on trades after rename\t—\tpost ↗\n2023-12-04\tMobile confirmation for API keys\tNo changelog\tSilent cookie-only key registration\t≈6 years after the 2017-era panels\tdev page ↗\n2023-10-24\tSMS MFA for game build publications\tYes\tSteamworks build publishing\t—\tannouncement ↗\n2023-07-12\tCustom biography content warning\tYes\tPhishing links in bios\t—\tforum ↗\n2023-01-25\tProfile {LINK REMOVED} & cooldown\tYes\tLinks in profile text\t—\tFAQ ↗\n2022-10-24\tLogin overhaul & cookie truncation\tNo changelog\tInfinite stolen sessions\t— (IAuthenticationService token migration)\tnews ↗\n2022-10-12\tMobile App 3.0 QR login\tYes\tSession deauthorisation panel\t—\tnews ↗\n2022-05-10\tTrade-cancellation endpoints removed\tNo changelog\tOffer-swap (cancel & re-send)\t≈5 years after the 2017-era panels\tissue #325 ↗\n2020-05-25\tDota 2 7-day trade lock\tYes\tFast item flipping\t—\tblog ↗\n2018-03-29\tCS:GO 7-day trade lock\tYes\tInstant bot laundering\t≈20 months after the July 2016 statement\tblog ↗ archived 2025-02-26 ↗\nSources: the linked Valve posts, help pages and GitHub issues, as dated. Three decisive fixes shipped with no changelog (2022-05, 2022-10, 2023-12) and were detected by users, not announced by Valve — that asymmetry is part of the enforcement record. Lags are computed only where the dossier's own dating (July 2016 statement; 2017-era scam panels) supplies the start point; \"—\" means no such start point is established here.\nPart A — Technical record · Section 6\nInteractive Exploit & Hijack Simulator\nContext & source limits\n\nA reconstruction of the path from the phishing message to the server-side key registration and the trade swap. Before 2023, a Web API key registered on an account could read its inventory, cancel a pending trade offer and create a new one, and no trade-confirmation screen was shown to the account holder for any of those actions. That is the absence of least privilege (OWASP A01:2021). The timings in this simulation are illustrative and are not live measurements of the current platform.\n\nStep through the reconstructed hijack. Each phase shows what the account holder sees and, beside it, the call Steam receives at the same moment. Every one of those calls is correctly authenticated. Nothing in the sequence needs Steam's authentication to fail — it needs the key it issues to carry no scope (OWASP A01:2021).\n\nWhat the player sees. What changes behind it.WALKTHROUGH SIMULATOR\nStep 5 / 5\n\nThe Exploit Completed. Expecting a mobile prompt for their original trade, the victim approves the replacement trade. This is an integrated forensic walkthrough showing how the absence of Least Privilege (OWASP A01:2021) enables automated, sub-second asset hijacking.\n\n01 / THE CHAT LUREA friend asks to voteVictim receives a message with a link.\n02 / THE LOGINA lookalike portalVictim enters sign-in credentials.\n03 / THE ACCESSSilent Web API creationAttacker registers a developer key.\n04 / THE SWITCHLegitimate trade swappedClone bot duplicates target recipient.\n05 / CONFIRMATIONCounterfeit approvedWrong offer approved on mobile.\nThe same step, seen from the networkReconstruction of the pre-2023 pattern · illustrative call shapes\nVictimApproves the mobile prompt that was expected for the original trade.\nAttackerReceives the items at the clone account.\nSteam seesA transfer confirmed by the account holder on a registered device.\nConfirmation genuine — made by the account holder\nRecipient the clone bot, not the intended counterparty\nThe confirmation is authentic. The offer it confirms is not the one the user initiated.\n\nThe record left behind: a trade the user approved. That is the record Steam Support reads when the complaint arrives, and the reason the archived complaints were closed as user error. The complaints are in the enforcement archive.\n\nPart A — Technical record · Section 7\nThe endpoints behind the sequence.\nContext & source limits\n\nThese are the Steam Web API endpoints that the reported hijack scripts used to intercept trades without passing through the browser-side confirmation steps.\n\nFour documented endpoints do the whole job. None of them is a flaw, none needed exploiting — a valid key calls them and Steam answers. The key is the only thing the attacker had to steal.\n\nIEconService / GetTradeOffers / v1POLLING\n\nUsed to monitor the account's trade offers. Scripts poll this endpoint repeatedly with the compromised API key; it returns the details of newly created, pending or modified trade offers. Polling intervals are not measured here.\n\nThreat vector: Discloses pending trade offer IDs and the recipient's profile details.\nIEconService / CancelTradeOffer / v1INTERACTION\n\nUsed to programmatically invalidate the user's legitimate trade offer. Before 2023 no step-up authentication protected the key, so an automated server could cancel an offer as soon as it was detected, without any prompt to the account holder.\n\nThreat vector: Voids the trade before the account holder completes the mobile confirmation.\nISteamUser / GetPlayerSummaries / v2RECON\n\nQueried to retrieve the profile name, avatar image URL and level of the legitimate trade recipient. This lets the script dress a prepared clone account to match. No timing is measured here.\n\nThreat vector: Supplies the data needed to impersonate the intended recipient.\n/dev/ajaxregisterkeyCREATION\n\nSteam's registration endpoint for keys. Historically, any active browser cookie session (`steamLoginSecure`) could register a key without a Steam Guard confirmation on the mobile device, and without any notification to the account holder.\n\nThreat vector: A persistent credential created by a script, unseen by the account holder.\nPart A — Technical record · Section 8 · GDPR Article 7\nA checked box. Whose action?\nContext & source limits\n\nIn declining reimbursement, Steam Support replies preserved in the archive take the position that the account holder created the API key and, by checking the box, accepted the terms.\n\nThe support response attributes the key to the account holder. The question is whether the record establishes who actually created it.\n\nIn the observed API-key hijack pattern, however, the victim never saw or navigated to the API key creation page. The consent field is submitted by a script executing a headless POST with the stolen session cookie.\n\nUnder GDPR Article 7 and Article 4(11), consent must be a freely given, specific, informed and unambiguous indication of the data subject's wishes. The authors' position is that a terms-acceptance field submitted by a hostile script with a stolen cookie, with no page shown to the account holder, cannot meet that definition. Whether it does is for the supervisory authority.\n\nForensic Payload Analysis: Key Registration\nPOST https://steamcommunity.com/dev/ajaxregisterkey\n// Request Payload (Injected via hijacking script)\n{\n\"agreeToTerms\": \"agreed\", <-- machine-injected, no human interaction\n\"domain\": \"localhost\", ← not validated — any value accepted, including localhost\n\"sessionid\": \"8f0d8ef763ab2140bf89de2a\"\n}\nThe question for the supervisory authority: where the account holder never clicked the consent field, whether the terms-acceptance recorded against the account meets Article 7's requirement of a freely given, specific, informed and unambiguous indication of the data subject's wishes, and whether Steam Support may rely on it to decline a claim.\n\nSource: request shape of key registration as reconstructed from the public endpoint and from hijack reports preserved in the evidence archive (searchable build of 2026-09-17) · the session identifier shown is a placeholder, not a captured value.\n\nForensic Autopsy · The Trade Substitution Vector\nHow Valve Finally Neutralized \"Trade Substitution\" — And Why It Took 7 Years of Workarounds\n\nFor nearly a decade, the \"API Key Trade Substitution\" (or API MitM Scam) was the most lucrative account theft model on Steam, siphoning hundreds of millions of dollars in skins from unsuspecting players. Valve did not eradicate the exploit by fixing the vulnerable API architecture; instead, Valve spent seven years layering four platform-wide friction barriers that crippled community trade liquidity while leaving the root cause unaddressed.\n\n1. The Mimicry Death\nAvatar & Name Cooldown (Feb 2024)\n\nThe exploit required sub-second mimicry: the scam bot intercepted an outgoing trade, scraped the recipient's avatar/name via ISteamUser, and cloned the profile in 200ms. On 14 February 2024, Valve quietly implemented a mandatory 2-to-4 hour trade cooldown (Error 34) immediately following any profile name or avatar change. A bot can no longer clone a recipient on the fly without locking itself out of trading.\n\n2. The Economic Death\n7-Day CS2 Trade Reversal (Jul 2025)\n\nValve introduced unilateral Trade Reversals for Counter-Strike items. Any traded skin is tagged \"Trade Protected\" for seven days. If a victim discovers a substitution, they click \"Reverse Trade\" in Steam Support, and the skin is instantly returned to their inventory while freezing the recipient. Because the 7-day trade lock prevents scammers from moving the item to a cashout site, the theft is rendered unprofitable.\n\n3. The Silent Key Death\nMandatory Mobile Push for API (Dec 2023)\n\nHistorically, a stolen session cookie allowed malicious scripts to execute a headless background POST to /dev/ajaxregisterkey without notifying the victim. On 4 December 2023, Valve mandated an explicit push confirmation on the Steam Mobile App to generate a Web API key, eliminating silent background key provisioning.\n\n4. In-App Mobile Warnings\nAccount Age & Name Banners (2022–2024)\n\nValve revamped the mobile confirmation modal to display the trade partner's Steam account tenure (creation date), Steam level, and an explicit amber warning: \"This user has recently changed their profile name\", breaking the visual illusion for attentive victims.\n\nThe Three Flaws in Valve's Patchwork: Why Scammers Simply Shifted Targets\n1. The Game Exclusion Loophole (Dota 2 & TF2)\n\nTrade Reversals were deployed exclusively for Counter-Strike 2. Dota 2 and Team Fortress 2 items remain completely unprotected due to crafting and socketing complexities. High-tier items worth thousands of dollars (Dragonclaw Hooks, Golden Baby Roshans, Unusual TF2 burning flames) carry zero reversal window. Scammers simply redirected automated API interception onto Dota 2 and TF2 traders, where Steam Support strictly enforces its 2016 \"no item restoration\" policy.\n\n2. The \"Zombie Key\" Reservoir (Zero Expiration)\n\nWhile Valve added mobile push 2FA to generate new keys in December 2023, Valve never revoked, expired, or purged existing legacy API keys. Millions of active accounts that generated keys (or had keys silently created by phishing/malware prior to Dec 2023) still carry active credentials with zero expiration (no TTL) and zero inactivity timeout. Threat actors maintain massive historical databases of these persistent keys, continuing to poll IEconService undisturbed.\n\n3. The Victim Penalty: 30-Day Trading Lockdown\n\nEven in CS2, Valve penalizes the scammed player: clicking \"Reverse Trade\" in Steam Support automatically inflicts a mandatory 30-day trade and Community Market ban on the victim's account. Valve punishes the user with a month-long platform exile as a deterrent against \"frivolous\" reversals, discouraging victims from reversing trades on lower-value liquid items.\n\nThe Core Regulatory Scandal: Seven Years of Workarounds vs. One API Scope\n\nWhy did Valve spend seven years inventing trade holds, account cooldowns, and reversible trade locks—disrupting the entire gaming economy and wiping out $104M in market capitalization—instead of implementing the industry-standard fix?\n\nAs proven by Valve's official Steamworks release on 16 January 2026 (Announcement #493839547938902179 ↗), Valve already built Granular Permission Groups (General, Microtransactions, Economy, Sales Data) and IP Whitelisting for corporate Publisher Keys. Valve had the engineering solution in hand for years. A single user-facing checkbox—\"Prevent this Web API key from accessing IEconService (Trade Management)\" or a home IP whitelist—would have eradicated the trade substitution scam in 2018 with zero economic collateral damage. Valve refused to give regular players the protection it engineered for corporate partners.\n\nPart B — Rules and enforcement record · Section 9\nTheir rulebook. The recorded platforms.\nContext & source limits\n\nThis ledger maps explicit clauses from the Steam Subscriber Agreement (SSA) and Steam Online Conduct (SOC) guidelines directly against active, large-scale commercial entities.\n\nThe rule: no commercial use, no gambling, no bots — and Steam Support quotes those clauses when it refuses to return a victim's items. The record: the same clauses, on their face, cover the commercial platforms in this register, which run on Steam identities, Steam bots and Steam transfers. The clause is enforced against the person who lost the skins and not, on any published record, against the businesses moving them.\n\nIn the archived complaints, Steam Support cites the \"No Commercial Use\" and \"No Automation/Bots\" clauses when declining to restore items to victims of API-key fraud. The same clauses apply on their face to the commercial platforms recorded in this dossier, which authenticate through Steam OpenID and move items through automated Steam accounts. No market-wide revenue figure is estimated here (see the enforcement statistics below). What the record shows is the rule applied to individual accounts in the archived cases and no published per-operator enforcement record for the platforms. That asymmetry is what this section documents.\n\nThe central question / selective enforcementRules → Scale → Accountability\nOne rulebook. Unequal enforcement.\n\nThe register shows commercial services using Steam identities, inventories, bots and transfers as operating infrastructure. The SSA prohibits commercial exploitation and automation without permission. The archived complaints show that rule applied to individual accounts, while the public record does not show an equivalent operator-by-operator account for the platforms documented here. Publish the rule, the evidence and the enforcement decision for each one.\n\n189websites in audit scope\n44separate-domain routes in the live register — 27 with a published evidence file, 17 manually collected. The 189-website browser audit alone resolved 25 of them; the register adds the hand-collected routes.\n12 yr 6 mocsgogem.com blocked in the Link Filter; api.csgem.com registered 2014-03-08 and never blocked — one of 26 such pairs as of 2026-09-22\nNo verified totalmarket-wide revenue estimate excluded\nSteam Online Conduct\n\"…you shall not do, or attempt to do, any of the following on Steam: […] Engage in commercial activity. Examples of such prohibited behavior include: posting advertisements; running contests; gambling; buying or selling Steam accounts; selling content, gift cards, or other items; and begging.\"\n\nstore.steampowered.com/online_conduct ↗ archived 2026-09-21 ↗\n\nSSA § 2.G — Commercial use\n\"…[you may not] exploit the Content and Services or any of its parts for any commercial purpose, except as expressly permitted elsewhere in this Agreement…\"\n\nValve's 2016 notices, as reported, invoked the personal, non-commercial licence. No operator has produced a Valve authorisation on the record. store.steampowered.com/subscriber_agreement ↗ archived 2026-09-18 ↗\n\nSteam Web API Terms of Use\n\"You may not use the Steam Web API or Steam Data in any way that violates the Steam Subscriber Agreement.\"\n\nThird-party skin marketplaces operate through automated accounts consuming the Steam API. The rule text leaves no exception for commercial scale. steamcommunity.com/dev/apiterms ↗ archived 2026-09-21 ↗\n\nSSA § 4.C\nAutomation\n\nScripts, bots and non-human interaction are restricted. The ledger records bot trading, account farms and automated routing at commercial scale.\n\nInspect 153records tagged under this clause ↗\nWhat the record holds under this clause153 tagged platforms\nCase Opening15\nSkin Casino13\nCS2 Market9\nSkin Roulette8\ncsgoempire.com→csgoempirelogin4.comCasino\nrollbit.com→rbsnin.comCrypto Casino\n500.casino→fivezerozero.coLicenced Casino\n\nOf these, 153 are also tagged under SSA § 2.G and 2 are also tagged under SSA § 1.C — the same services fall under more than one clause, which is why the examples repeat.\n\n28 of the 153 were observed authenticating through a separate registrable domain. A tag records a dated observation that brings the platform within the clause on its face; it is not an adjudicated violation, and no Valve authorisation has been produced for any of them.\n\nSSA § 2.G\nCommercial use\n\nCommercial exploitation requires express permission. Compare the documented business models, their scale and any disclosed authorisation or enforcement.\n\nInspect 175records tagged under this clause ↗\nWhat the record holds under this clause175 tagged platforms\nCase Opening15\nSkin Casino13\nCS2 Market9\nSkin Roulette8\ncsgoempire.com→csgoempirelogin4.comCasino\nrollbit.com→rbsnin.comCrypto Casino\n500.casino→fivezerozero.coLicenced Casino\n\nOf these, 153 are also tagged under SSA § 4.C and 24 are also tagged under SSA § 1.C — the same services fall under more than one clause, which is why the examples repeat.\n\n28 of the 175 were observed authenticating through a separate registrable domain. A tag records a dated observation that brings the platform within the clause on its face; it is not an adjudicated violation, and no Valve authorisation has been produced for any of them.\n\nSSA § 3.A\nVPN & location disguise\n\nDisguising residence through IP proxying can lead to termination. Separate-domain auth hosts require a separate analysis: establish what is disguised and which rule applies.\n\nInspect the auth-host evidence ↗\nSteam Help / URL policy\nLink obfuscation\n\nSteam prohibits link shorteners and tools that obscure link destinations. A separate auth domain — rbsnin.com in Rollbit's login flow, auth.dota.trade in CS.MONEY's — raises the comparable question of whether the destination shown to Steam's OpenID verifier identifies the operating site.\n\nValve's URL policy ↗\n\nRule references: Steam Subscriber Agreement, revision 10 September 2026 archived 2026-09-18 ↗ · Steam Web API Terms of Use archived 2026-09-21 ↗ · Steam URL policy (link obfuscation). Counts describe this dossier's records and tags; they are not a count of adjudicated violations.\n\nThe trust deficit\nWho reviews the decision when support closes the case?\n\nThe preserved complaints describe permanent sanctions, unanswered challenges and refusals to restore stolen items. Test those accounts against the actual ticket history, available remedies and account-access logs. A generic phishing explanation cannot establish who initiated a reset or created an API key.\n\nRead the captured complaints ↗Request the underlying records →Moderator relationship graph →\nPart B — Rules and enforcement record · Section 10\nAn automation API. A rule against automation.\nContext & source limits\n\nThe question this section puts is how the two are reconciled: which uses of the API are authorised, by whom, and on what published criteria. No count of authorised commercial API users is estimated here, and none is implied by the absence of a published list — the absence is the finding, not a number behind it. The Steam Support messages quoted above are reproduced by the ArchiSteamFarm project in its own FAQ (verified verbatim 2026-09-22); they are not Valve publications, and the accounts they were sent to are not identified.\n\nThe rule (SSA § 4.C): no scripts, no bots, no non-human systems on Steam. The record: Valve ships a headless REST API whose entire purpose is server-to-server automation, and hands the key to any account. Users are banned for automation; the automation interface is Valve's own product. Which commercial uses are authorised has never been published.\n\nThe \"Game Developer\" Fallacy\nSteamworks SDK (Legitimate)\n\nUsed by legitimate game studios to integrate achievements, matchmaking, and leaderboards into their game clients. Requires complex C++ integration and official partner onboarding.\n\nSteam Web API (The Loophole)\n\nA headless JSON/REST architecture designed for external web servers. In the hijack pattern documented here it is used to read inventories and manipulate peer-to-peer trades from remote servers; its legitimate uses are not catalogued in this dossier.\n\nWho the key is forAn ordinary Steam user has no in-client need for a Web API key; the key page lives under a developer URL and its documented purpose is external, server-side access. The archived hijack complaints describe victims who did not know the page existed until a key had been registered on their account.\nThe Automation Contradiction\n\nSSA § 4.C provides: \"You may not use any form of scripts, bots, macros, or other non-human-controlled systems ('Automation') to interact with Content and Services on Steam in any manner.\" Yet the Web API endpoints (like CancelTradeOffer) require no human UI and no captcha and bypass the Steam client entirely. The API is designed for server-to-server automation; the rule prohibits automation by users; the boundary between the two is not published.\n\nA server-side position in the trade flow\n\nA Web API key lets a third-party server act on the account's trades without the Steam client. In the hijack pattern, that server sits between the account holder and the trade server.\n\n→No trade-confirmation screen is shown for the key's actions.\n→Allows background polling (GetTradeOffers).\n→Cancels and re-issues offers without user interaction.\nValve built the interface, prohibited user automation in its rules, and has published no criteria for which commercial uses are authorised.\nPart B — Rules and enforcement record · Section 11\nTen days demanded. Ten years to account for.\nContext & source limits\n\nOn 20 July 2016 Valve's general counsel gave gambling operators a 10-day deadline. Ten years later (as of the dossier snapshot, 2026-09-21) at least one platform named in press reports of that notice, CSGOFast, is still operational with a separate-domain auth host. The wording is reconstructed below from press reports of 21 July 2016; the reconstruction is not a scan. The enforcement record the notice implied has not been published. The open letter to the Commission is Section 2.\n\nRead the July 2016 notice beside the later observations. The outstanding demand is an operator-by-operator enforcement record.\n\nOne week earlier — 13 July 2016, in public\n\nOn 13 July 2016 archived 2026-09-21 ↗, Valve described how gambling sites used Steam: OpenID for account identification and automated accounts for trading. Valve stated that using those mechanisms to run a gambling business violated its API and user agreements. Both the description of the mechanism and the prohibition are in Valve's own dated statement. On 2026-09-21 the separate-domain auth hosts tested returned no Link Filter block, and Valve has published no per-operator enforcement record.\n\nEXHIBIT A / JUL 2016TYPESET RECONSTRUCTION\nVALVE CORPORATION\n\nBellevue, WA\n\nDATE:July 2016 (reported by press 21 July 2016)\nFROM:Karl Quackenbush, General Counsel\nRE:Cease and desist — commercial use of Steam accounts\nNOTE:Reconstruction of reported text; not a scan\n\n\"We are aware that you are operating one of the gambling sites listed below. You are using Steam accounts to conduct this business. Under the Steam Subscriber Agreement, Steam and Steam services are licensed for personal, non-commercial use only.\"\n\n\"You should immediately cease and desist further use of your Steam accounts for any commercial purposes. If you fail to do this within ten (10) days, Valve will pursue all available remedies including without limitation terminating your accounts.\"\n\nDossier reconstruction · consult the source record\nKarl Quackenbush\nGeneral Counsel, Valve Corp.\nIN THE MARGIN / EDITORIAL\nTen days.Then what?\n\nThe deadline was specific. The public follow-through should be, too.\n\nValve’s published 2016 position ↗\nA note to the deadline +\nSATIRE / NOT VALVE CORRESPONDENCE\n\nDear deadline,\n\nYou were given ten days. Somehow, the calendar was the only thing that kept working.\n\nPlease forward any reply to the public record.\n\nTimelineJuly 2016 – September 2026\nDeadline in the notice:\n10 Days\nJuly 2016\nElapsed since the notice:\n3,715 Days\nFixed count from 20 July 2016 to the dossier snapshot of 21 September 2026, not a live figure\nPublished enforcement record:\nNone\nNo per-operator account of terminations or blocks located\n\n◀ Days 0–10 — the deadline, to scaleDay 3715 — the snapshot ▶\n\n20 Jul 2016Ten-day demand issuedDay 0\n17 Feb 2024DSA obligations applyDay 2,768\n25 Feb 2026NY AG complaint announcedDay 3,507\n21 Sep 2026Dossier snapshotDay 3715\n\nTen years later, CSGOFast — named in press reports of the 2016 notices — is operational: csgofast.com returned a Link Filter block on 2026-09-19 and 2026-09-21, while its auth host steam-login.authtofast.com (registered 2026-06-30) did not.\n\nFull dated record of Valve's security changes: Security Timeline → · The Washington record and the enforcement standard: below\n\nWhat the record shows: the 2016 notice set a 10-day deadline; Valve already operated a domain list (the Link Filter) and received the auth hostnames in its own OpenID requests; no per-operator enforcement record has been published. Community reports describe a 2018 action against a marketplace (SkinJar), but those reports are unverified and are not relied on here.\nCSGOFAST / THE SAVED AUTHENTICATION ROUTE\nFollow the declared return host.\n\nThe saved route record links csgofast.com to steam-login.authtofast.com. The separate hostname is carried in the Steam OpenID request. It gives investigators a concrete address to compare with Valve's filtering and enforcement records.\n\nInspect the CSGOFast route and its source ↗ · Compare saved Steam Link Filter results ↗\n\nPUBLIC RECORD / WASHINGTON · 2016 → 2026\nTwo deadlines. One unanswered enforcement standard.\n20 JUL\nValve gives gambling sites 10 days\n\nIts counsel's demand warned that continued commercial use of Steam accounts could lead to termination.\n\n27 SEP\nWashington presses Valve\n\nThe state's Gambling Commission demanded evidence of steps to stop skin transfers for gambling and set a 14 October response deadline.\n\n17 OCT\nValve rejects the charge\n\nValve answered after the deadline, disputed that it facilitated gambling, said it had disabled associated accounts, and said it did not want to switch off trading and OpenID for everyone. At least one platform named in press reports of the July notices (CSGOFast) was operating a decade later. Both facts can hold only if the operator replaced the disabled accounts; the record that would show this has not been published. The WSGC should ask Valve to reconcile the two.\n\n2026\nThe routes observed in September 2026\n\nThe route register records 44 platforms authenticating through separate-domain auth hosts, including CSGOFast, using the OpenID and trading mechanisms Valve described in 2016. The enforcement record that would show which operators were cut off has not been produced.\n\nTHE COMMISSION'S OWN BRIEFING · 30 JANUARY 2018\nEighteen months after Valve replied, the regulator still called it an intent.\n\nBriefing its own legislature at the HB 2881 public hearing, the Commission described the July 2016 statement in its own words: Valve \"announced its intent to crack down on the use of its platform to facilitate skins gambling.\" The same page records what that announcement did to the industry forecast — \"as a result,\" the projected 2020 skin-gambling market was revised from $19.7 billion to $670 million, a cut of about 97 per cent, on the strength of the announcement alone. The forecast moved. The per-operator enforcement record that would justify it has still not been published.\n\nThe market figures are Narus Advisors / Eilers & Krejcik Gaming estimates reproduced in the Commission's briefing, not Commission findings; the same document puts 2016 skin wagering at about $5 billion, roughly $3 billion of it on casino-style sites. Retrieved 2026-09-22, SHA-256 c507c9025f93da0aadaf395c4d8882f25973211c318ee8e9b6f18a5b3755e050.\n\nValve's public 2016 position and today's observable infrastructure can be put side by side. The question is whether enforcement reached the accounts and routes used by prohibited operators. A ten-day notice is not evidence that the notice was carried out across the operators it named. The 2018 OPSkins action is the one documented intervention against a named operator; set against 189 platforms checked and no published per-operator record, one documented action does not show a pattern of enforcement.\n\nWashington Gambling Commission's 2016 notice ↗ archived 2026-05-20 ↗ · Valve's 17 October 2016 response (document copy) ↗ · WSGC briefing to the legislature, 30 January 2018 (local copy, 4 pp.) ↗ · the same file on wsgc.wa.gov ↗ · retrieval record & hash ↗ · Valve's 2018 OPSkins action ↗ archived 2026-03-07 ↗ · Current route audit ↗\n\nForensic Longitudinal Audit · 2016 Cease & Desist Targets\nThe 10-Day Notice Decade: Forensic Survival Audit of the 23 Named Sites\n\nOn 19–20 July 2016, Valve General Counsel Karl Quackenbush issued formal cease-and-desist notices to 23 skin gambling platforms, ordering them to cease commercial use of Steam accounts within 10 days under threat of account termination and legal action. Over 3,700 days later, an empirical audit reveals the true pattern of enforcement: multiple operators never ceased operations, others ran for up to six years after the deadline, and the multi-billion-dollar ecosystem continued to leverage Valve's OpenID architecture.\n\n5+ LIVE\nDefiantly operational in 2026 (CSGOBig, CSGO500, CSGOFast, etc.)\n6 YEARS\nLongest post-notice run before closure (CSGOatse active through 2022)\n$5.01B\n2016 skin wagering volume (Narus / Eilers & Krejcik)\n200+\nActive skin gambling sites operating at market peak\nThe Surviving Titans · 2024–2026 Financial & Traffic Blueprint\nFrom 10-Day Warnings to Offshore Conglomerates: The Multi-Billion-Dollar Turnover\n\nRather than eliminating skin gambling, Valve's 2016 notices catalyzed an industrial evolution. The surviving operators restructured as offshore corporate entities (Curaçao, Belize, Cyprus), pioneered Peer-to-Peer (P2P) trading to bypass bot bans, and now process over 10 million monthly web visits and billions of dollars in annual wagering handle while continuing to authenticate through Steam:\n\nPlatform / Domain\tJuly 2016 Notice\tEnforcement Outcome & Survival Status\tRecorded Verification / Primary Links\nCSGOBig\ncsgobig.com\t10-Day Notice (Jul 2016)\tSTILL LIVE IN 2026\nTemporarily paused, relaunched; authenticates via letmeinbig.com & csgobiglogin.com\tX: @csgobig ↗ · FB: csgobigofficial ↗\nCSGO500\ncsgo500.com / 500.casino\t10-Day Notice (Jul 2016)\tSTILL LIVE IN 2026\nRebranded into 500 Casino (Curaçao license #8048/JAZ2014-037), multi-million monthly turnover\tLive Platform (500.casino) ↗\nCSGOFast\ncsgofast.com\t10-Day Notice (Jul 2016)\tSTILL LIVE IN 2026\nActively operating roulette, crash, and jackpot via steam-login.authtofast.com\tDossier Auth Audit ↗\nCSGOLounge / Dota2Lounge\ncsgolounge.com / dota2lounge.com\t10-Day Notice (Jul 2016)\tSTILL LIVE IN 2026\nPivoted to esports coin wagering and crypto betting; maintained continuous operation\tLive Platform ↗\nCSGOCasino\ncsgocasino.net / csgocasino.gg\t10-Day Notice (Jul 2016)\tLIVE VIA SUCCESSOR (2026)\nDomain redirected; active successor portal operates under csgocasino.gg\tSuccessor Domain ↗\nCSGOatse\ncsgoatse.com\t10-Day Notice (Jul 2016)\tSURVIVED 6 YEARS (ACTIVE TO 2022)\nContinued full gambling operations for six years following Valve's 10-day ultimatum\tX: @CSGOatsecom (Active to 2022) ↗\nCSGOSweep\ncsgosweep.com\t10-Day Notice (Jul 2016)\tSURVIVED TO DEC 2017\nOperated publicly for 17 months after deadline\tX: CSGOSweep Status Dec 2017 ↗\nCSGOWild\ncsgowild.com\t10-Day Notice (Jul 2016)\tSURVIVED TO DEC 2017\nPromoted by major influencers; ran for 1.5 years post-C&D before crypto migration\tX: @Wild (Active Dec 2017) ↗\nCSGOPot\ncsgopot.com\t10-Day Notice (Jul 2016)\tSURVIVED TO SEPT 2017\nOperated high-stakes jackpot betting 14 months past notice\tX: @csgopot (Active Sep 2017) ↗\nCSGODiamonds\ncsgodiamonds.com\t10-Day Notice (Jul 2016)\tSURVIVED TO MID 2017\nRan through 2017 despite admitted outcome tampering for sponsored streamers\tX: @csgodiamondscom (2017) ↗\nCSGOLotto\ncsgolotto.com\t10-Day Notice (Jul 2016)\tCLOSED JULY 2016\nShut down under public scandal; target of federal FTC consent order\tFTC Consent Order (Docket C-4632) ↗\nCSGODouble\ncsgodouble.com\t10-Day Notice (Jul 2016)\tCLOSED JULY 2016\nShut down voluntarily immediately after C&D publication\tX: @CSGODouble (Closed Jul 2016) ↗\nCSGOMassive\ncsgomassive.com\t10-Day Notice (Jul 2016)\tCLOSED 2016\nCeased public operations in late 2016\tX: @csgo_massive ↗\nCSGOStrong\ncsgostrong.com\t10-Day Notice (Jul 2016)\tCLOSED 2016\nCeased public operations in 2016\tFB: csgostrongfree ↗\nSkins2\nskins2.com\t10-Day Notice (Jul 2016)\tCLOSED 2016\nCeased public operations in 2016\tFB: CSNCOM ↗\n\nPlatform\tMonthly Traffic (Visits)\tEstimated Turnover / Volume\tCorporate Entity & Jurisdiction\tKey Regulatory Actions & Model\nCSGOEmpire\ncsgoempire.com\t2.3M — 9.0M / mo\nAvg 6+ min duration; 80% direct\t$1.5B — $2.5B Annual Handle\n>1,000,000 P2P skin trades/mo; $6.4M active liquid order floor\tMoonrail Limited B.V. (Curaçao #148182)\nPayments: JHOLT LTD (Cyprus); Founder: \"Monarch\" (Ossi Ketola)\tPioneered 0% fee P2P item trading; licensed Curaçao OGL/2024/1183/0869\nCSGORoll\ncsgoroll.com\t2.74M — 3.5M / mo\nAvg 9m 23s duration; 16% bounce rate\t$1.0B — $2.0B Annual Handle\nEst. $100M–$200M annual corporate revenue from house edge\tFeral Holdings Limited\nHeadquartered in Belize City, Belize (Reg #171519)\tBanned by Australian ACMA (May 2023); sponsored tier-1 team G2 Esports with underage players\n500 Casino (CSGO500)\n500.casino / csgo500.com\t220K — 425K / mo\n~105k unique monthly visitors\t$100k / week ($5.2M/yr) in Royales\nHigh-roller wagering requirement: $400 wager per $1 rakeback\tPerfect Storm B.V. (Curaçao #150536)\nCuraçao Gaming Control Board license OGL/2024/1354/0882\tBanned by Swedish Spelinspektionen (Nov 2023) for unlicensed targeting of Swedish players\nCSGOBig\ncsgobig.com\t~169,600 / mo\nAvg duration 19m 12s; US primary\tMulti-Million Annual Volume\nMystery boxes, roulette, and case battles\tOperates via auxiliary proxy routing\nletmeinbig.com (reg 2023) & csgobiglogin.com\tTarget of July 2016 C&D; relaunched with proxy auth architecture\nCSGOFast\ncsgofast.com\t~150K — 250K / mo\nGlobal multi-language audience\tMulti-Million Annual Volume\nHigh-velocity roulette and crash games\tOffshore operational entities\nRoutes Steam auth via steam-login.authtofast.com\tTarget of July 2016 C&D; never discontinued operations; active in 2026\nCSGOPolygon\ncsgopolygon.com / plg.bet\t~300K — 500K / mo\nCIS and Eastern European dominance\tMulti-Million Annual Volume\nCrypto & skin roulette, match betting\tSecond-wave target (Oct 2016)\nPivoted to cryptocurrency with mirror domain plg.bet\tSurvived a full decade; continues skin liquidation via third-party APIs\nThe Second Wave: Why Valve's C&D Targeted 43+ Sites in Total\n\nOn 17 October 2016, Valve's legal counsel formally disclosed to the Washington State Gambling Commission that following the initial 23 notices on July 19, Valve had sent cease-and-desist letters to more than 20 additional skin gambling sites (bringing the official total above 43). This second wave was necessitated because the initial list inexplicably omitted the largest, most notorious gambling hubs in the world:\n\nCSGOJackpot.com: The historic originator of skin jackpots, which handled hundreds of millions in volume before shuttering under threat of federal indictment.\nCSGOShuffle.com: The site at the heart of the July 2016 streaming scandal, where Twitch streamer PhantomL0rd secretly owned 33% of the company and was exposed rigging odds with house funds.\nThe Macro Ecosystem (200+ Operators): According to industry research by Narus Advisors and Eilers & Krejcik Gaming, over 200 distinct skin gambling sites operated in 2016, generating $5.01 Billion in wagering volume from 3.03 million active players. Valve's 43 letters addressed less than 20% of the active market.\nOfficial Government & Regulatory Investigations on Steam Skin Gambling\n\nThe skin gambling phenomenon is documented across multiple formal statutory inquiries, enforcement actions, and government position papers:\n\n1. Washington State Gambling Commission (WSGC) (2016–2018)\n\nIssued formal Cease & Desist demand on 5 Oct 2016; published Legislative Briefing on 30 Jan 2018 documenting that skins are cash equivalents and reporting the $5.0B skin wagering volume.\n\nWSGC Legislative Report PDF (Local Copy) ↗\n2. U.S. Federal Trade Commission (FTC) (Sept 2017, Docket C-4632)\n\nFirst federal regulatory enforcement action involving skin gambling against CSGOLotto owners Trevor Martin and Thomas Cassell for deceptive practices and undisclosed platform control.\n\nFTC Decision & Consent Order ↗\n3. UK Gambling Commission (UKGC) Position Paper & Youth Audits\n\nFormally classified in-game skins as \"money or money's worth\" under Gambling Act 2005. Subsequent surveys found over 11% of children aged 11–16 had bet skins on video games.\n\nUKGC Research Repository ↗\n4. Australian Senate Environment & Communications Inquiry (2018)\n\nFederal Parliamentary report on \"Gaming micro-transactions for chance-based items\", evaluating Valve's loot box mechanics, secondary market cashouts, and regulatory circumvention.\n\nParliament of Australia Inquiry ↗\nThe outstanding demand\n\nPublish the enforcement record: which gambling accounts and bots were disabled, which return hosts were restricted, and which commercial services received permission. A public prohibition and a homepage warning do not establish that the underlying operation was stopped.\n\nPart B — Rules and enforcement record · Section 12\nThe hostname is already in the request.\nContext & source limits\n\nValve already maintains a domain list (the Link Filter) and already receives the auth hostname in every OpenID request. The pseudocode below shows the logical shape of connecting the two. No public evidence shows that Valve does so.\n\nValve already runs a domain blocklist. Valve already receives the login host in every OpenID request. Nothing needs building — the two have to be joined. That is a hostname lookup against a list Valve maintains itself. The pseudocode below is an illustration, not Valve's implementation.\n\nforensic_autoban.py\n# ILLUSTRATIVE PSEUDOCODE — Valve.block_domain() and flag_session_as_mitm() are not real API calls. This demonstrates the logical structure of a mitigation Valve could implement against proxy auth domains, not actual Valve internals.\n# Illustration: the logical shape of a check on the incoming OpenID request\ndef audit_openid_request(request):\nblocked_origins = database.get_blacklisted_platforms()\nproxy_domain = request.params.get('openid.realm')\ntarget_redirect = request.params.get('openid.return_to')\n\n# Logic: If the proxy routes back to a blocked site, ban the proxy.\nfor site in blocked_origins:\nif site in target_redirect:\nValve.block_domain(proxy_domain)\nValve.flag_session_as_mitm(request.session)\n# Result: the login request for that host is refused\n\nObservation:\nWhere a main domain is already on the Link Filter (e.g. howl.gg, blocked 2026-09-18/19/21) and its auth host (howl.uno) appears in the OpenID request from that site's login button, the association is observable to Valve from its own request data. The check is automatable; whether it is run is not.\nDocumented and reported precedents\n\nValve has intervened against a third-party operator at least once on the record: in 2018 it revoked OPSkins' access over the ExpressTrade system (Valve's announcement ↗ archived 2026-03-07 ↗). Community reports from 2018 also describe a marketplace (SkinJar) losing access; those reports are unverified and the mechanism is inferred from the outcome, not from a disclosed process.\n\nWhat the precedent establishes:\n\nValve can cut off a third-party operator's access when it decides to. CSGOFast, named in press reports of the July 2016 notices, was operating on 2026-09-21 with an auth host registered 2026-06-30 that returned no Link Filter block. Why one operator was cut off and others were not is not explained by any published criteria.\n\nWhat a registration date does and does not show\n\nThe registration date of an auth host is a lower bound on when the host could first have appeared in an OpenID request; it does not establish continuous use. sc-auth.net, for example, was registered 2019-04-02 (RDAP) and was observed in Skin.Club's Steam login flow in September 2026; what happened between those two dates is not in the public record.\n\nComparative Audit: API Compliance Standards\nEnforcement Dimension\tGitHub API Rules\tSteam Web API (Valve)\n1. Compliance Neutrality\tPublished, uniform rules. Documented rate limits (e.g. 5,000 calls/hr for authenticated users, 15,000/hr for GitHub Enterprise Cloud organisations) and published acceptable-use policies apply to every account.\tNo published criteria. Individual accounts are terminated under the automation and commercial-use clauses (archived complaints), while no per-operator enforcement record for commercial platforms has been published.\n2. OpenID / Auth Proxy Abuse\tGitHub's published policies allow OAuth apps and tokens to be suspended or revoked for abuse, and its documentation describes automatic revocation of exposed tokens (authors' summary of GitHub documentation).\tSeparate-domain auth hosts observed in Steam OpenID flows (e.g. rbsnin.com, howl.uno, sc-auth.net) returned no Link Filter block on 2026-09-21 while their main domains did.\n3. Monetization of Abuse\tGitHub takes no transaction fee on items moved by third-party automation; its revenue model is subscriptions and marketplace listings.\tValve sells the case keys that produce the items, and the Community Market charges a combined fee of about 15% on sales completed inside the Market. No figure for revenue attributable to third-party platforms is estimated here.\n4. Evasion Loop Lifespans\tSuspended OAuth client IDs stop working platform-wide at suspension; the documentation does not publish a time-to-action figure and none is assumed here.\tSeparate-domain auth hosts with registration dates from 2011 to September 2026 returned no Link Filter block in the checks of 2026-09-19 and 2026-09-21. Registration date is a lower bound on possible use, not proof of continuous use.\nSources: GitHub column — GitHub's published API rate-limit and platform-policy documentation (authors' summary, not quoted) · Steam column — Link Filter checks of 2026-09-19 and 2026-09-21 (linkfilter-recheck-2026-09-21.json), RDAP registry (domain-registration.json) and the archived support complaints (evidence archive).\nPart B — Rules and enforcement record · Section 13\nThe off-Steam price gap\n\nThe item sits in a Steam inventory; the sale happens elsewhere. A Factory New AWP Dragon Lore had 62 live offers on CSFloat; the cheapest asked $10,623.95. Steam's own market cannot display an asking price above approximately $1,800. To sell for the observed higher price, an owner needs an off-Steam buyer or marketplace. The item and its transfer still depend on Steam.\n\nWhat this means — the Community Market listing ceiling\n\nSteam’s own market refuses a listing above roughly $1,800. A seller may ask less, never more. Items whose market price sits above that line therefore cannot be sold at that price on Steam at all — which is the mechanism that moves those sales to third-party venues while the item itself never leaves Valve’s inventory system.\n\nSection 13 — the off-Steam price gap →\n\nContext & source limits\n\nThree different counts appear in this section and they are not interchangeable. 245 is the number of CS2 item-name categories whose cheapest active offer exceeded $1,800 on CSFloat alone, 20 September 2026. 241 is that same set minus the four categories pinned at CSFloat's $100,000 ceiling, which is the panel the $13.63M floor is calculated on. 248 is a different snapshot: categories priced above the cap by two or more of five marketplaces on 23 September 2026. The marketplaces overlap, so counts from different venues must never be added. Every figure here is an asking price, not a completed sale, and none of it is revenue, turnover or profit — for Valve or for anyone else. PriceEmpire's listed values are rounded estimates published by that site, and its Steam card covers items from other Steam games, so the scopes across the comparison are not identical.\n\nOne item. Two price systems.FOLLOW THE RECORD\nStep 3 / 3\n\nAt that ask, the seller needs an off-Steam venue or buyer. The item still depends on Steam's inventory and transfer system.\n\nSTEAMAbout $1,800Published Community Market listing cap\nSAVED CATALOGUE$10,623.95Factory New AWP Dragon Lore floor ask\nTHE DEPENDENCYStill a Steam itemThe inventory and transfer remain on Steam\n01 / ITEMValve game inventoryCS2 or Dota 2 item held in Steam\n02 / CEILINGAbout $1,800 on SteamMaximum price for one Market listing\n03 / OUTSIDE ASK$10,623.95 for Dragon LoreCheapest CSFloat offer in the dated snapshot\n04 / DELIVERYSteam remains in the chainOwnership and item transfer rely on its system\nMARKET ARCHITECTURE · DATED SNAPSHOT, 20 SEPTEMBER 2026\nThe price gap is measurable.\n\nWe counted item-name categories whose cheapest active offer was strictly above $1,800. CSFloat and Skinport are separate snapshots with overlapping CS2 inventories; their counts cannot be added. The outside offers show where higher asking prices are posted, while Steam still controls item ownership and transfer.\n\n245CS2 CATEGORIES · CSFLOAT\n166CS2 CATEGORIES · SKINPORT\n3DOTA 2 CATEGORIES · SKINPORT\n$10,623.95DRAGON LORE FLOOR ASK\n\nDragon Lore: 62 active CSFloat offers in the Factory New category; the displayed floor is an ask, not a confirmed sale. Steam permits listing the item for less, but cannot post the observed higher ask. Valve’s 2016 statement confirms its awareness of gambling operators using OpenID and Steam trade infrastructure. Whether a particular third-party marketplace breaches Valve’s rules must be established separately.\n\nInspect the full register →CSFloat JSON ↗Skinport JSON ↗Valve’s 2016 statement ↗\nDIRECT CSFLOAT API / DATED SNAPSHOT$13.63M\n\nMinimum aggregate asking value in 241 item categories and 3,395 active offers. Calculated as each category's cheapest ask × its offer count. Four categories pinned at CSFloat's $100,000 ceiling are excluded from this conservative panel.\n\nWhat the dollar figure shows\n\nThese offers represent at least $13,631,888.25 in posted asking prices for this limited CSFloat subset. Including the four ceiling-priced categories produces $14,231,888.25. This is a floor on active asks, not completed sales, cash turnover, profit or the entire CS2 market.\n\nRecalculate from the 245-row CSFloat snapshot ↗\nPRICEEMPIRE / LISTED VALUESteam: #15 of 39\nMany venues list more dollar value than Steam.\nUUSkins\n$133.8M\nYouPin898\n$127.5M\nBuff.163\n$104M\nMoon.Market\n$100.3M\nWhite.Market\n$89.6M\nBuff.Market\n$86.7M\nSteam\n$31M\n\nThe six largest displayed values and Steam. PriceEmpire rounds these figures; Steam shows $31M. Fourteen listed venues rank ahead of it by the displayed dollar values.\n\nPRICEEMPIRE / OFFER COUNTSteam: #1 of 39\nSteam still leads in number of offers.\nSteam\n32.2M\nYouPin898\n5.9M\nC5Game\n4.6M\nHaloSkins\n4.4M\nSkinport\n3.8M\n\nSteam shows 32.2M offers. Number of offers and total asking value answer different questions; many low-priced listings can dominate the count.\n\nSource: PriceEmpire's public comparison ↗ archived 2026-09-21 ↗, captured 2026-09-20 19:03 UTC; dated 39-row extraction ↗. Its figures are rounded estimates, and inventory can overlap across sites. Steam's card also describes items from other Steam games, so the scopes are not identical. Listed value measures asking prices, not sales or revenue.\n42\nANOTHER SOURCE / STEAMANALYST\nThe commercial ecosystem is in plain sight.\n\nSteamAnalyst's marketplace directory archived 2026-07-19 ↗ lists 42 third-party CS2 marketplaces alongside Steam, with recent price data for 32 of the 43 entries. PriceEmpire lists 39 marketplaces under its own inclusion criteria. Named businesses, public offers, visible prices: this economy is open to inspection.\n\nTHE CEILING IS THE MECHANISM: THE SALE LEAVES STEAM, THE ITEM DOES NOT.\n\nAcross five marketplaces captured in one licensed snapshot, 248 CS2 item categories are independently priced above Steam's approximately $1,800 listing ceiling by two or more of them — and every single one is absent from Steam. The same snapshot banded the whole catalogue by price: Valve's market carries 95.3% of the item categories below its cap and 1.9% of those above it. The collapse does not track falling demand; it lands exactly on the published rule. Selling at those prices requires an outside buyer or marketplace, while Steam still controls the inventory and the transfer — the business leaves Valve's checkout and the delivery stays on Valve's infrastructure.\n\nSteam Market FAQ ↗archived 2026-09-21 ↗Steam Subscriber Agreement ↗archived 2026-09-21 ↗Five-marketplace atlas dataset ↗Provenance manifest ↗Earlier CSFloat snapshot ↗Skinport snapshot ↗PriceEmpire ↗archived 2026-09-21 ↗SteamAnalyst ↗archived 2026-07-19 ↗Price-gap register ↗Price-ladder atlas ↗\n\nPart C — Legal frameworks\nPart C — Legal frameworks · Section 14 · Personnel access\nWho can reset the safeguards?\nContext & source limits\n\nAccount security also depends on the people who can recover an account, inspect private records or reset its safeguards. The investigation must follow those privileged actions as closely as it follows API abuse.\n\nAccount recovery hands a support agent the power to move an account away from its owner. Valve has confirmed in writing, twice — February 2023 and November 2025 — that this power was used to hand accounts to the wrong people. Thirty-three months apart, through the same channel. Below: what that access is worth, six sourced cases, and the log Valve holds for every one of them and has produced to nobody.\n\nPreserved testimony / 9 May 2025\nA recovery ticket that disabled the account's security, and a reported $10,000 loss\n\nA user in the collected support archive reports that Steam Support reset the password and disabled account protection after another person submitted a recovery ticket. The author says the account had been inactive for years, held items since 2016–2017 and had Steam Guard, a linked phone and stored recovery codes.\n\n\"Steam Support still gave someone else access to my account.\"\n\nFirst-person allegation, preserved in steam_support_tickets_MEGA.json, record 110. Read the complete captured post ↗\n\nThis is not one user's bad luck. The same door — a help request that moves an account to whoever supplies the older data — is the documented way in for every case in the ledger below, and Valve has twice put that in writing.\n\nThe owner cannot win that argument. Recovery asks for the first CD key, the first email, the first card, the first phone number. Those facts are in Valve's database, and support-side access reads them — reported as reaching back fifteen years. A person who has a copy of your file will always produce more of your history than you can. Targets were picked to fit: dormant for years, high-value, and often bought second-hand, so the holder never knew the original key. Afterwards the accounts were deleted outright, breaking the item-history trail the community uses to trace a skin — a deletion an ordinary user cannot perform without the standard waiting period.\n\nLeast privilege / OWASP A01\n\nRecovery privileges should be limited to the task, independently reviewed and logged. Audit who could reset credentials, remove Steam Guard, read billing records or export account data. OWASP access-control guidance ↗ archived 2026-09-20 ↗\n\nBroad support accessAccess-scope risk\nBeyond the inventory.\n\nIf broad support access is abused, private telemetry can become a tool for profiling, targeted phishing and surveillance. Potential victims include ordinary users, military personnel, public figures and their families. This is a threat model; the exact permissions require access-control records.\n\n01 IP history & location\nIP logs can expose network history and approximate location. They do not, by themselves, establish precise physical movements.\n02 Device fingerprinting\nDevice identifiers, where collected and accessible, can connect sessions and accounts.\n03 Activity telemetry\nLogin timestamps and session records can reveal routines, including activity invisible on a public profile.\n04 Communications & contacts\nAccess to retained messages or contact information would increase the scope for profiling and social engineering.\n05 Identity unmasking\nOriginal email, phone and payment records can connect a pseudonymous account to a person.\n06 Data resale & accountability\nExported target lists could support targeted scams. Establish the actor, access location, recipients and transfers; location alone establishes neither access nor legal immunity.\n\nValve describes IP logging, device information, payment records and third-party support providers in its Privacy Policy §§ 3, 5.2 archived 2026-09-21 ↗. The policy authorises third-party support access — the audit trail that would show which contractor accessed which category, when, and under what authorisation has not been disclosed.\n\nSection 14.1 · the register · June 2022 → November 2025 · every figure sourced\nValve admitted the door twice, thirty-three months apart. It never closed.\n\nSix reported cases in which accounts were taken through Steam's own help-request channel, or through the credentials that channel protects. Each amount is the figure the cited source published, and each source is named. Two of the six were made whole. The difference between them and the rest was not what happened — it was who was watching.\n\nValve, in writing — February 2023\"The items in question were removed from your account because they were received from an account that was compromised through a support help request, for which the CS:GO team takes responsibility. We have reversed the trades and removed them from any account which received them.\"Steam Support reply to a recipient of HFB's items, reproduced by Dexerto, 21 February 2023 ↗ archived 2025-08-18 ↗\nValve, in writing again — November 2025 · 33 months later\"A support technician that handled the help request failed to follow our process which resulted in your account restored to someone else. I apologize for this error.\"Steam Support reply to Hawkeye337, quoted in Dexerto, 14 November 2025 ↗\n21 Jun 2022\nHFB — the largest inventory in the game$2,000,000+ · raised to $3,000,000+ in the February 2023 follow-up\n\nSeven Souvenir AWP Dragon Lores and the #1 Blue Gem Karambit, that knife alone valued at about $1.26 million. The account had been dormant three years with the mobile authenticator still active; the email and password were changed anyway, through the support recovery route.\n\nThe money left before the items did. A reported $200,000+ of sale proceeds was already withdrawn through market.csgo.com — a marketplace that settles in cash and crypto. Reversing a trade returns a skin. It does not return the cash somebody already banked.\n\nAnd the fix broke. One buyer moved his Souvenir Dragon Lore into an in-game Storage Unit. Valve's rollback script could not see inside its own container, so it issued the owner a fresh copy and left the hidden one standing — Valve duplicated a $130,000 item while trying to undo a theft. It was caught by matching item IDs and community reporting, and deleted a month later, in July 2022. The buyer was refunded by BUFF, not by Valve. Emergency remediation this brittle is not a control; it is what a platform does when it has no control.\n\nDexerto, 21 Jun 2022 ↗ archived 2022-07-02 ↗ · Kaspersky ↗ · cash-out figure per Esportfire, 22 Jun 2022 ↗ archived 2026-05-15 ↗, attributed there to multiple Twitter sources · duplication and deletion per Esportsbetting, 14 Jul 2022 ↗\n\nRestoredTrades reversed. Items pulled back out of the inventories of people who had paid full price for them.\n14 Aug 2022\nCS.Money — the platform's own bots$6,300,000 · 19,000+ skins · first estimate $1.6M\n\nAttackers took the mobile-authenticator files of the marketplace's trading bots and emptied them, then sent part of the haul to well-known traders to blur the trail. Community researchers mapped 55 attacker accounts within hours and published them.\n\nValve reversed nothing. The reason given was that a third-party site sits outside Steam — the same Steam whose inventory, trade API and account system the theft ran on end to end.\n\nEsportfire, 14 Aug 2022 ↗ archived 2025-11-15 ↗\n\nRefusedNo reversal. Loss stayed with the platform and its users.\nReported\n21 Feb 2023\nQkss — same door, same actor$1,000,000+\n\nReported as taken the same way HFB was, by the same actor, through the same support help request. HFB was made whole eight months earlier. Qkss was not.\n\nOne route. Two answers. Nothing in the published record distinguishes the two cases except the size of the audience.\n\nDexerto, 21 Feb 2023 ↗ archived 2025-08-18 ↗\n\nRefusedNot restored.\nReported\nFeb 2023\nThe insider trade itself — a year of it≈ $320,000 · proceeds over roughly one year, not an inventory valuation\n\nSupport-side access reached account history up to 15 years old — the first CD key, the first email, the first card. That is exactly the evidence the recovery process asks for, which is why the person holding the database always wins the argument against the person holding the account.\n\nBlogger Mzkshow exposed how insider operator \"Steam Help\" and collaborator \"Alexander\" targeted dormant accounts holding over $100k in skins. One stolen M4A4 Howl carrying iBUYPOWER and Titan Katowice 2014 holos sold for $35,000 and ended up with NAVI's Valerii \"b1t\" Vakhovskyi, who had no way of knowing. After Valve intervened, the contractor dismissed its entire Steam support desk.\n\nVKPlay ↗ · Lis-Skins ↗ · Escorenews (RU) ↗ · Dexerto (EN) ↗\n\nNo registerValve has never published how many accounts this touched, or told the people it touched.\nReported\n2 Dec 2024\n\"Matvey\" — after the sackings$13,000\n\nRecovery was granted to someone who supplied account data the owner himself could not match. Two years after the contractor cleared out its Steam support desk, the same route produced the same result.\n\nPreserved post, 2 Dec 2024 ↗ archived 2025-08-05 ↗ · source rows & hashes ↓\n\nRefusedNot restored.\n13 Nov 2025\nHawkeye337 (Mark Spurlock) — and the second admission≈ $300,000–$500,000 · full Katowice 2014 holo collection\n\nThe attacker demanded 1 bitcoin and began scraping the collection onto Negevs to destroy it. Steam Support's written reply is the second admission above: a technician handled the help request, did not follow the process, and gave the account to someone else.\n\nWhat produced the fix was the feed. Hours after the posts tagging Valve went up on X, the account was taken back and every sticker restored. Qkss did not have that audience.\n\nSkin.club ↗ · Dexerto ↗ · Esportfire ↗ archived 2025-12-17 ↗\n\nRestoredReversed within hours of the story trending.\nWhat the ledger says that no single case does.\n\nThe route never closed. The first admission is dated February 2023 and the second November 2025 — thirty-three months apart, with the contractor's mass dismissal, a documented recurrence and a $6.3 million platform breach in between. Counting from the first theft in this ledger, the channel stayed open for three years and five months. Whatever was fixed in 2023, the help request still moved an account to the wrong person in November 2025 — Valve's own sentence.\n\nRestitution tracked attention, not harm. Restored: the biggest inventory in the game, and the collector whose thread trended. Refused: $1,000,000, $6,300,000, $13,000. Valve has never published the rule it applies, because a published rule would have to explain those three.\n\nNobody was told. Not the users whose account histories were read out of the database, not a supervisory authority, not the market that bought the items in good faith and had them clawed back. There is no breach notice, no incident report, no count of affected accounts — and the proceeds left as money, through marketplaces that pay in cash and crypto. A trade reversal cannot follow money out of Steam.\n\nValve holds the support audit trail, the recovery-ticket log and the transaction record for every line above. None of it has been produced. Ask for your own copy →\n\nThe NDA question\nConfidentiality must come with technical accountability.\n\nCompare confidentiality agreements with actual permissions, export controls, reset approvals and access logs. A canned response cannot resolve an allegation that the recovery process itself was abused.\n\nGDPR Articles 28, 32–34\n\nArt. 33 gives a controller 72 hours to notify the supervisory authority of a personal-data breach; Art. 34 requires telling the affected people when the risk to them is high. Valve has confirmed in writing, twice, that its support channel handed accounts to the wrong people — account history, billing records and all. No notification under either article has been published, and no affected user has reported receiving one. Read the regulation ↗ archived 2026-09-20 ↗\n\nInclude support access in your request →\nPart C — Legal frameworks · Section 15 · Commercial scale\nFollow the money. Separate the transactions.\nContext & source limits\n\nThe commercial-use question becomes sharper when the money flows are separated. Third-party item transfers, Valve's primary sales and external cash-outs are different transactions.\n\nThe item is Valve's. The inventory is Valve's. The transfer runs on Valve's servers. Only the payment happens somewhere else — which is the step that decides whether anyone is a money transmitter, and the one step Valve does not operate.\n\nThe revenue mechanism\nWhere the money actually moves.\nThree paths / one item economy\n01 / AccountUser inventory\n\nItems held on Steam\n\n02 / TransferP2P trade\n\nUser ↔ bot or user ↔ user\n\n03 / SettlementExternal platform\n\nSite balance or payment off Steam\n\nCirculationThe economic engine extends beyond a transfer fee\n\nSteam supplies the inventory and transfer infrastructure used by outside markets. The investigation's economic argument is that resale liquidity and repeated demand sustain spending on cases, keys and replacement items, with fees on subsequent Community Market sales. A direct P2P transfer carries no Community Market commission; that accounting fact does not settle the wider benefit. Valve retains control over account access and trading restrictions throughout.\n\n01 / Secondary demandLiquidity & resale value\n\nExternal trading and gambling demand\n\n02 / Primary spendingKeys, cases & capsules\n\nPurchases from Valve where offered\n\n03 / RevenuePrimary-sale income\n\nPlus fees on actual Market sales\n\n5% + 10%Steam + CS2 fee on Community Market sales\n\nThe investigation's economic inference: liquid resale markets can encourage spending on new items. The familiar 15% combines Market fee rates, subject to minimums and rounding; it is not a levy on every external trade.\n\nValve's Community Market fee schedule ↗ archived 2026-09-21 ↗. On 25 February 2026 the New York Attorney General filed an action archived 2026-09-01 ↗ alleging that paid loot boxes are connected to external cash resale and gambling harm — the same connection this dossier documents from the technical-infrastructure side. That complaint is an allegation, not a finding; it is cited here because a state law-enforcement agency has put to Valve a question adjacent to the one this dossier asks: where is the enforcement record that matches the public declarations?\n\n01 / EntryCrypto deposit\n\nExternal service and wallet records\n\n02 / ConversionBalance → skins\n\nItems delivered through Steam trades\n\n03 / ExitExternal fiat sale\n\nSeller, buyer and payout provider\n\nKYC?Identify the control at every handoff\n\nThis is the route to investigate, not a native Steam API cash-conversion service. Document identity checks, custody, transaction IDs and payout recipients at each external operator before asserting a no-KYC cash-out.\n\nUnited States / Bank Secrecy Act\nClassify the activity, then the obligation.\n\nFinCEN assesses money transmission by what a business does. Accepting and transmitting convertible virtual currency can trigger money-services obligations, subject to the applicable definitions and exceptions. Valve's Steam Wallet accepts funds and converts them to in-game items; those items are then liquidated through third-party operators for real currency. The item and its transfer run on Valve's infrastructure; the cash-out does not, and whether any part of that cycle meets the money-transmission definitions is a classification question for FinCEN, not a conclusion drawn here.\n\nFinCEN FIN-2019-G001, §§ 1–2, 5.1 ↗ archived 2025-07-11 ↗\n\nEuropean Union / money laundering\nTrace proceeds, knowledge and assistance.\n\nDirective (EU) 2018/1673 covers intentional laundering and participation involving criminal proceeds. The investigative question is what Valve knew about the operators using its trading and OpenID infrastructure after 13 July 2016, when it publicly described that use, and what it did about them. Valve has published no per-operator enforcement record; that record, not this dossier, would answer the question.\n\nEU criminal-law framework ↗\n\nAMLD6 terminology: the criminal-law directive above is distinct from Directive (EU) 2024/1640, also called AMLD6. The latter has a general transposition deadline of 10 July 2027, with specified exceptions. Article 78 ↗ archived 2026-08-30 ↗\n\nPart C — Legal frameworks · Section 16 · Notice, response, responsibility\nThe Digital Services Act: put knowledge on the record\nContext & source limits\n\nTwo elements of an Article 16 notice sit with the submitter rather than with this dossier: the submitter's own details and a statement of good faith that the information is accurate. Everything else the Article requires — the substantiated explanation and the exact electronic location — is set out in Section 3 and in the route register, with saved responses and hashes, so that any party can lodge it. Two further limits on the law itself: losing the hosting exemption does not by itself establish liability under any other law, and the 6% in Article 52(3) is a statutory ceiling, not an assessed penalty against Valve.\n\nUnder the DSA a hosting provider keeps its liability shield only until it has specific knowledge and fails to act. This dossier is that notice. It names the hosts, the dates, the saved responses and the hashes. From publication the question is no longer whether Valve knew — it is what Valve did next.\n\n01July 2016 / the dossier exhibit\nA ten-day demand.\n\nThe notice reconstructed above is the historical starting point for the investigation's enforcement comparison.\n\n0217 February 2024 / general application\nThe DSA time window.\n\nSeparate historical conduct from conduct during the period when the relevant DSA obligations apply.\n\n03Ten years / original dossier snapshot\nDuration needs a notice trail.\n\nThe elapsed time since July 2016 (see Section 11) is a dossier metric. It is not ten years of established DSA violations. Link each notice to a specific item, applicable law, delivery evidence and response.\n\nArticle 52(3) / statutory ceiling6%\nof annual worldwide turnover\n\nMaximum fine for a breach of DSA obligations, using the provider's preceding financial year. This is a legal ceiling, not an assessed penalty against Valve.\n\nArticles 6, 8 & 16 / the legal test\n\nFor relevant hosting services, specific knowledge and failure to act expeditiously can remove the hosting exemption. A sufficiently precise notice can establish knowledge of the particular content. The DSA imposes no general monitoring duty; loss of the exemption does not itself establish liability under another law.\n\nDSA: Articles 6, 8, 16, 52, 53, 93 and recital 17 ↗ archived 2026-09-20 ↗\n\nReview preserved complaints ↗Build the account timeline →Full legal & economic analysis →\nPart C — Legal frameworks · Section 17 · Identity, age, commercial access\nMinors: a Steam login is not an age check\nContext & source limits\n\nNo minor's data appears anywhere in this dossier and none was collected: the authors did not register on, deposit at, or complete a login to any platform named. Anyone building on this section should keep evidence involving a child private and redact identifying details from public exhibits. COPPA is cited here as a children's privacy law with its own scope conditions — audience, actual knowledge, personal data collected — and not as a general gambling-age rule; the 2026 New York complaint is an allegation by a state authority, not a finding.\n\n\"Sign in with Steam\" proves an account exists. It proves nothing about age — and on these sites it is the only gate between a child and a deposit. Read it with Section 3.1: inside the Steam client the warning a browser would show never fires, so the child never sees one.\n\nWhat Steam OpenID providesAccount identity\n\nA verified SteamID used to log in or link an account.\n\n≠\nWhat the operator must establishEligibility to participate\n\nAge, jurisdiction and any required identity checks.\n\nTechnical basis: Steamworks OpenID documentation ↗ archived 2026-09-21 ↗. The documented identity assertion is not a certification that the user may legally gamble.\n\nCOPPA / children under 13\nIdentify the operator and the data.\n\nCOPPA applies to covered child-directed services and services with actual knowledge that they collect personal information from children under 13. It is a children's privacy law, not a universal gambling-age rule. Establish the audience, personal data collected, knowledge and parental-consent process.\n\nFTC: COPPA requirements ↗ archived 2026-09-21 ↗\n\nThe evidence to preserve\nRecord the journey from login to deposit.\n\nPreserve the site's age gate, registration wording, eligibility terms, payment flow and complaint history. Assess each operator separately. Keep any evidence involving a child private and redact identifying details from public exhibits.\n\nA related public enforcement record is the 2026 New York complaint announcement archived 2026-09-01 ↗, which alleges harm to young users from paid loot boxes. It is not a COPPA finding.\n\nPart C — Legal frameworks · Section 18 · GDPR Article 15 request\nThe request. The reply. The missing comparison.\n\nHe asked for four things, one of them the log that would name whoever put an API key on his account. Three days later the ticket was closed with a link to a page that holds none of them — and the sentence used to close it is contradicted by Valve's own lawyers.\n\nWhose account this is · Provenance & Limits\n\nThese screenshots are not PhishDestroy's. They come from an ordinary Steam account holder — one respondent to a short survey run by this project, who filed the request himself and supplied the captures. The account is his, the ticket is his, and the correspondence is between him and Steam Support. This project did not submit the request, holds no account on the platform, and is not a party to this ticket.\n\nOn 16 September 2026 he filed a GDPR/CCPA Article 15 subject access request asking specifically for API-key registration logs, login history with IPs, device authorisation history and trade history. On 17 September agent \"Logen\" referred him to the self-service Account Data page. On 18 September he stated that the requested categories were not on that page and asked for escalation to the Privacy Team or DPO. On 19 September agent \"Kal\" closed the ticket with the same referral. Both screenshots are preserved below (requester e-mail redacted; SHA-256 in steam_tos_assets/screenshot-manifest.json).\n\nHe is a fitting requester for an ordinary reason: his account carries a Steam Web API key he did not create, registered to localhost. When it was created is not known — not to him, and not from anything Valve has made available to him, because the single record that would date it is the API-key registration log, which is exactly the category the closure withheld. The key is not new: it predates his awareness of it by an interval he cannot measure, for the same reason.\n\nOther account holders are filing the same request. Any reply that arrives will be added here on the same terms as these two — ticket number, capture date, SHA-256, requester redacted — whether it supplies the categories or refuses them.\n\nThis project takes no position on why the ticket was closed. No reason was stated in it, and none is inferred here.\n\nThe request. The response. The comparison.FOLLOW THE RECORD\nStep 3 / 3\n\nHe asked for four named categories. The Account Data page he was referred to is Valve's own self-service export, and this project cannot enumerate its contents for someone else's account — so no full category-by-category comparison is published here. What is on the record is his statement of 18 September that the categories were not there, and the closure of 19 September that repeated the referral without addressing them.\n\nTHE REQUESTSpecific categoriesAPI-key, login, device and trade records\nTHE RESPONSEAccount Data referenceInspect the support exchange\nTHE TESTWhat was supplied?Compare each requested category\nScreen 1/2 — Request (16 Sep) and first reply, agent \"Logen\" (17 Sep)\nGDPR ticket HT-2YBP-F7JP-D4VB — request and first response\nSource: help.steampowered.com, ticket HT-2YBP-F7JP-D4VB · captured 16–17 Sep 2026 · requester e-mail redacted 2026-09-21 · File: gdpr-ticket-1.png · SHA-256 da940c731ab9869d226e9d06ccc8a1b393738766b7b0c445a56662623e025a66 (screenshot-manifest.json).\nScreen 2/2 — Escalation request (18 Sep) and closure, agent \"Kal\" (19 Sep)\nGDPR ticket HT-2YBP-F7JP-D4VB — escalation request and closure\nSource: help.steampowered.com, ticket HT-2YBP-F7JP-D4VB · captured 18–19 Sep 2026 · File: gdpr-ticket-2.png · SHA-256 44844ea7b251f7fd7d79f87ee1578a846606a97b9659d3a53b322120c422219b (screenshot-manifest.json).\nClosing response, 19 Sep (verbatim):\n\"The data Steam retains can already be found in your Account Data page. As there's no further information Steam Support can offer, this request will be closed.\"\nNo data supplied · no legal basis for refusal stated · no escalation outcome shown\nThat sentence is false, and Valve's own lawyers prove it. Counsel's letter of 1 October 2025, paragraph 1.9, describes device-level correlation linking one device to dozens of accounts (Appendix A). The same response carried 830 pages of retained records (Appendix B). None of it is on the Account Data page.\nWhy this account asked for the API-key log\n\nHe did not pick those four categories at random. The localhost key on his account is the mark of a script, not of a person typing a real domain into the developer page (Section 5, Section 6). The one record that shows who created it and from where is the API-key registration log. That was the first thing he asked for. That is what the closure withheld.\n\nSource: the account holder, during this project's survey. The ticket screenshots above are hashed; the key page is not published.\n\nAssessment · PhishDestroy\n\nClosing a ticket with the question still open is not an accident here. It is the normal outcome. We hold 16,319 preserved complaint and support records and 354 de-duplicated support exchanges drawn from them. This ticket is one dated, fully captured example of the shape they take.\n\nSupport Ticket — PreservedHT-2YBP-F7JP-D4VB\nRequest typeGDPR Article 15 DSAR\nTicket statusCLOSED 19 SEP 2026 — NO DATA SUPPLIED\nAgents in the exchange\"Logen\" (17 Sep), \"Kal\" (19 Sep)\nFiled16 Sep 2026\nData requestedWho registered the Web API key linked to this account, and from which IP / device / timestamp\nLegal basis citedGDPR Art. 15 — right of access to personal data\nThe legal frame:Article 12(3) gives the controller one month from receipt (extendable with reasons). That period had not expired at publication, and this dossier does not assert a deadline breach. The objection is to the substance: the closing response links to a self-service page but does not show that the four named data categories were produced, and if the controller declines to act, Article 12(4) requires it to state the reasons and the complaint routes. Neither appears in the closing response.\nWhy this specific data matters\n\nThe Web API key event log is the record that shows whether a third party registered a key using a stolen session cookie — the mechanism described in the inventory-theft complaints preserved in this dossier's archive. Disclosing who registered an API key, from which IP, and at what timestamp, would:\n\nAllow the victim to compare the API creation IP against their own login history\nReveal data-centre IPs linked to known phishing / gambling bot infrastructure\nProduce evidence usable in civil or criminal proceedings against the actor\nShow whether the account holder was notified when the key was created\nWhat the record shows: Valve retains device-level and account-correlation records — its counsel's letter of 1 October 2025 describes them (see Appendix A, Evidence Memorandum — Source 1). In ticket HT-2YBP-F7JP-D4VB the same class of records was requested by the data subject and the ticket was closed with a referral to a self-service page that the data subject reported did not contain them. Whether that refusal is lawful is a question for the supervisory authority; the effect is that the person the data concerns does not get it.\nThe exchange — four messages, three days\n\nTwo Steam Support agents replied under first names shown on the ticket: \"Logen\" on 17 September and \"Kal\" on 19 September. Both referred the requester to the Account Data page. Nothing on the ticket shows whether the request reached Valve's Privacy Team or Data Protection Officer, and the dossier does not assert who the agents are, what their roles are, or how the ticket was routed.\n\n16 SEP\nArt. 15 request filed with four named data categories\n17–18 SEP\nReferral to Account Data; requester asks for DPO escalation\n19 SEP\nTicket closed with the same referral; no data, no stated basis\nWhat Article 15 GDPR explicitly entitles the subject to\nArt.15(1)(a)Processing purposes — why Valve holds the data\nArt.15(1)(b)Categories of data — what Valve holds\nArt.15(1)(c)Recipients or categories of recipients — who received the data (e.g., API key holder)\nArt.15(1)(d)Retention period or criteria for determining it\nArt.15(3)A copy of the personal data undergoing processing — i.e., the API-key log itself\nART.12(3)Response required within one month of receipt; an extension must be communicated within that month. The period had not expired at publication. Art. 12(4): if the controller does not act, it must state why and inform the subject of the complaint routes.\nRegulatory complaint pathway — for any user\n\nAny user who submitted an Article 15 GDPR request to Valve and received no compliant response (or a template refusal without data) may file a complaint with the supervisory authority in their EU/EEA member state. Valve's EU establishment is Valve GmbH in Hamburg, so the lead supervisory authority for cross-border complaints is the Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI). (Valve's Article 27 representative is also located in Hamburg; a representative's address does not by itself determine the competent authority.) A complaint may also be filed with the authority of the complainant's own member state under Article 77.\n\nHmbBfDI complaint form ↗ GDPR text (Art. 12, 15, 77) ↗ archived 2026-09-20 ↗EDPB guidelines ↗\n\nTicket reference for any complaint: HT-2YBP-F7JP-D4VB — preserved in this dossier as a documented instance.\n\nOne documented instance\nThe records exist; the data subject did not receive them.\n\nValve's counsel described device-level correlation records in a letter of 1 October 2025. On 19 September 2026 an Article 15 request for the same class of records was closed with a referral to a self-service page the requester reported did not contain them, without a stated legal basis. Ticket HT-2YBP-F7JP-D4VB is one documented instance; whether it reflects a wider practice is a question for the supervisory authority, which can ask Valve for its handling records.\n\nGDPR Articles 12, 15, 77 / Supervisory authority\n\nA complaint under Articles 12 and 15 can be lodged directly with the relevant supervisory authority without cost (Article 77). The authority may impose corrective measures including orders to comply with the access request, and fines under Article 83(5)(b) for infringements of data-subject rights. Preserving the original ticket reference and any Valve response (or its absence) strengthens a complaint.\n\nSee the DSAR template →\nPart C — Legal frameworks · Section 19 · Contract law\nThe Subscriber Agreement against the platform's own architecture\nContext & source limits\n\nThe authors are not lawyers and none of this is legal advice. The SSA is quoted from the revision of 10 September 2026; a different revision may read differently, and clause numbering has changed across revisions — check the clause against the version that governed the conduct in question. The Articles 25 and 32 arguments state what the regulation requires, not that a supervisory authority has found a breach. The figures in Argument 1 carry the scope limits set out in Section 13.\n\nThree of the SSA's central provisions sit awkwardly with how the platform is built: the commercial-use prohibition against a Market price ceiling that pushes high-value sales off-platform; the user-liability clause for API keys against a key endpoint that, before 2023, required no second factor; and the enforcement language against a public record that shows no per-operator enforcement. Whether these tensions affect enforceability is a question for a court; this section sets out the facts a court would have before it.\n\nArgument 1 / Market Cap Architecture\nThe Market ceiling and the commercial-use prohibition\n\nThe Steam Community Market has a listing ceiling of about $1,800. Across five marketplaces in a dated snapshot (23 Sep 2026), 248 CS2 item categories are independently priced above that ceiling by two or more of them; such items cannot be sold at those prices on Valve's own platform. Owners who want those prices use third-party markets, which run on Steam accounts and the Steam API — use that the SSA classes as commercial unless expressly permitted.\n\nItems exceed the Market ceiling → third-party markets fill the gap → those markets use Steam accounts and the Steam API → the SSA prohibits commercial use without permission → no register of permissions has been published. The Community Market's combined fee of about 15% applies only to sales completed inside the Market, not to these external trades.\nArgument 2 / API Key Security Architecture\nThe API-key vulnerability as a platform design question rather than user negligence\n\nBefore 2023, Steam's API key creation endpoint accepted a POST with a stolen sessionid and generated a high-privilege credential without e-mail confirmation, a second factor or device verification. The API hijack complaints collected in this investigation follow one pattern: attacker script, stolen session cookie, silent key creation, trade interception (the request payload is shown in Section 8).\n\nGDPR Article 25 (data protection by design) and Article 32 (security of processing) require technical measures appropriate to the risk. Issuing a credential capable of trade interception without a second factor or owner notification is a design question for the controller. Whether the SSA clause placing liability on the user can be relied on against that background is a question for a court and the supervisory authority.\n\nArgument 3 / Real-Time Visibility\nValve receives the auth hostname on every login\n\nThe auth hostname arrives at Valve's OpenID endpoint in plaintext in openid.return_to and openid.realm (the request shape is shown in Section 3). Extracting it is a standard operation. As of 2026-09-22, in 26 pairs the main domain was on the Link Filter while the host carrying its Steam login was not. Valve has published no per-operator enforcement record, so whether any measure other than the Link Filter has been applied to these hosts cannot be established from public data.\n\nWho bears the cost\nThe pattern in the archived complaints\n\nIn the reviewed complaints, Steam Support's response to an API-key hijack claim follows one form: decline restoration, cite the user's responsibility for the account and its API key, close the ticket. No aggregate figure for accounts affected or value lost is estimated in this dossier; no source for such a figure has been located.\n\nThe question is not whether individual users made mistakes. The question is who is responsible for an architecture that, until 2023, allowed a POST request with a stolen cookie to create a high-privilege trading credential with no notification and no second factor.\nThe SSA as a document vs the SSA as a contract\nA court evaluating this record would not read the SSA in isolation.\n\nIt would read it alongside counsel's October 2025 letter describing device-level correlation, the auth-host registration dates, the batch registration timestamps, the API-key request payload, and the ten years between the July 2016 notices and the platforms still operating in September 2026. That is the record Valve would have to address.\n\nSSA against the record / key points\n\"No commercial use\" — the Market ceiling pushes high-value sales to commercial third-party markets\n\"Users liable for API keys\" — no second factor on the key endpoint before 2023\n\"We enforce against violators\" — no per-operator enforcement record published since July 2016\n\"You agreed to terms\" — in the hijack pattern the acceptance is submitted by a script, not the account holder\nConclusion · What the record establishes and what we ask\nThe findings. The records we ask for.\nContext & source limits\n\nEach finding below is tied to a dated public record in the sections above. The requests are addressed to the authorities that can compel the one thing this investigation cannot reach: Valve's own enforcement, access and processing records.\n\nEach request follows a dated finding. The authorities can seek records that this public-source investigation cannot compel.\n\nWhat the public record establishes\n44 live platforms authenticate through a separate registrable domain — 27 with a published per-route evidence file, 17 from manual collection and listed apart. As of 2026-09-22, 26 pairs had the main domain blocked in the Steam Link Filter while the host carrying its login was not — csgogem.com blocked, api.csgem.com registered since March 2014. Steam receives that hostname in openid.realm and openid.return_to on every login. Section 3\nOn 13 July 2016 Valve publicly named the mechanism and prohibited it, and its counsel's notices of 20 July 2016 set a ten-day deadline. No per-operator enforcement record has been published in the ten years since that deadline. Section 11\nThe Steam Web API key endpoint issued a high-privilege, trade-capable credential from a session cookie alone, with no second factor before 2023. Section 5\nA GDPR Article 15 request (ticket HT-2YBP-F7JP-D4VB) was closed after three days with a link to self-service and no data. Section 18\nWhat we ask each authority\nWashington State Gambling Commission\nReopen the 2016 file. Request an operator-by-operator account of which accounts, bots and return hosts were disabled after the ten-day notices, and which operators later regained access. Section 2\nHmbBfDI (Hamburg; Valve GmbH)\nTest whether the Article 15 response met the controller's duty, and require disclosure of the API-key registration and access records relevant to identifying the actor. Section 18\nDSA digital-services coordinators\nPut the auth-host routing on the record as notice, then assess whether Valve's response meets its obligations once knowledge is documented. Section 16\nAny data subject\nUse the Article 15 template to request the same records for your own account; a retained record can test who initiated a reset or created a key. Appendix G\n\nThe single request behind all four is the same: publish the enforcement, access and processing records that only Valve holds. A homepage warning, a ten-day letter and a self-service page are assertions of control. Whether control was exercised is a question the public record cannot answer and a regulator can.\n\nAppendices — primary exhibits and working materials\nAppendix A — Counsel correspondence\nEvidence Memorandum — material provided by Source 1\n\nEvidence base and source status for the counsel correspondence relied on in Sections 1, 18 and 19.\n\nEvidence Base and Source Status — documents provided by Source 1\nThe user whose permanent ban triggered this audit is not the subject of it. Whether that ban was justified is not examined here, and this dossier neither defends nor disputes it. The account is not the point. What matters is the material: Source 1 — the banned account holder, who received the correspondence below from Valve's counsel as the data subject of their own GDPR request — passed on that correspondence and the accompanying case files, together with the right to examine them publicly. The name is withheld; the documents are described by date, producer metadata and hash.\n\nThat correspondence was sent in response to a GDPR/DSAR request. In the course of it, Valve's counsel put a statement on the record, under signature, describing a capability that Steam Support had previously told users was not technically possible. The paragraph quoted below is that statement.\n\nThe authors' further analysis of the produced log extract is withheld from this dossier pending independent review. It is not relied on by any other part of this investigation.\n\nThe admission on the record: persistent device-level telemetry\n\nIn paragraph 1.9 of the letter attributed to Valve's counsel, Valve's attorneys state: \"Between 2019 and 2023, this account was used primarily from a device that was also used to log into dozens of stolen Steam accounts.\"\n\nThe Fact: Valve's counsel here describes device-level correlation across accounts spanning four years. Steam Support has told theft victims that tracking stolen items or linking accounts to devices was not technically possible. Steam Guard device authorisation is publicly documented, so the existence of per-device records is not itself new; what is new is counsel's written confirmation that those records are retained and correlated across accounts over multi-year periods.\n\nWhy this matters: the correlation that can link one device to dozens of hijacked accounts over four years is the same class of record Support said it could not use for victims. Records of that class would be capable of identifying accounts and devices in a theft-and-resale chain. Which records exist, how long they are retained, and on what basis they are withheld from data subjects are the questions for the supervisory authority.\n\nSource: letter of Valve's counsel dated 1 October 2025, paragraph 1.9, and its 830-page PDF appendix · received by Source 1 in response to a GDPR Art. 15 request · SHA-256 of the appendix recorded in disclosure-audit.json · the letter itself is not reproduced; account names and third-party data are omitted.\n\nStatus: open\nSource materials are available through the evidence archive.\nAppendix B — The produced PDF · redaction check\nThe redaction in the produced PDF is cosmetic: the covered text remains extractable\n\nValve's counsel answered a GDPR access request with an 830-page appendix in which the redactions are painted over the text rather than removing it. 902,270 characters sit under the black bars and come straight out with a text-extraction tool — including the third-party identifiers the bars were there to withhold. Only aggregate counts are published here; no covered content is reproduced, and the appendix itself is not published.\n\n1. What the geometry check found\n\nThe GDPR Art. 15 response dated 1 October 2025 was accompanied by an 830-page PDF appendix (Aspose.PDF for .NET producer metadata, created and modified on the same date). The authors ran a page-level geometry check: for each page, opaque near-black rectangles painted after the text layer were located and the extractable characters lying beneath them were counted.\n\nMeasured on the produced file\n902,270\nCharacters still extractable from under the black bars\nCounted, not estimated. This is a count of covered characters — not of victims, re-identifications or incidents.\n830 / 830\nPages affected — every page\n986\nRectangles over extractable text\n1,329\nOpaque black rectangles in total\nThe black bars are drawn over the text layer; they do not remove it. Text under the bars can be extracted with standard PDF tools. Only aggregate counts are published; no covered content is reproduced here.\nForensic Demonstration: Layer Separation\nASPOSE.PDF FOR .NET VECTOR OVERLAY MOCKUP (APPENDIX P. 412)\n\nReport filed against account: [LOGIN: redacted_user_667]\n\nReason submitted by user: [TEXT: \"User reports duplicate items in inventory and abusive trade conduct...\"]\n\nForeground: <path fill=\"#000\" />Flaw: Underlying UTF-8 stream intact\nSource: PDF appendix to the counsel letter of 1 October 2025 (830 pages, Aspose.PDF for .NET producer metadata) · measured by the authors, method and per-page counts in disclosure-audit.json · SHA-256 of the appendix recorded in the same file · the appendix itself is not published.\n2. Why this matters for a data-subject response\n\nValve's counsel sent this file to a data subject in answer to a request for that person's own records. The bars on it are cosmetic: the text underneath was never removed, so the third-party identifiers the bars were applied to withhold went to the recipient along with the file. A redaction that lifts with a text-extraction tool withholds nothing, and it also leaves the recipient unable to establish what was disclosed and what was not.\n\nArticle 15(4) is the reason those bars exist at all: the right to obtain a copy must not adversely affect the rights and freedoms of others. That is the obligation this production did not meet. Whether it is characterised as a personal data breach under Art. 4(12) is for the supervisory authority to determine; the disclosure itself is measurable in the file, and reproducible by anyone holding the same bytes — the SHA-256 is published, the appendix is not.\n\nWhat was under the bars was not account numbers. It was the body of user reports filed against the requester, with their authors attached: Steam logins that, because a login is rarely used only on Steam, identify the person behind them — on the authors' count, over 60% of the users named in the document are fully identifiable — together with the raw, unredacted text of what they wrote. That text includes death wishes and abuse directed at the requester's nationality. Some of the people so identified are minors. The production handed a named list of reporters to the person they had reported, which is the precise harm Art. 15(4) is written to prevent.\n\nThe sequence around the file matters as much as its contents. The request was met first with a demand for further proof of identity, on the ground that the requester's alias email address did not contain his name; the account was permanently banned during the delay that followed. The letter that finally delivered the data, more than six weeks past the Art. 12(3) month, threatened the recipient with criminal prosecution and withheld the remainder of his own data until he explained his account activity to counsel. The disclosure also settles two questions Valve has not answered in public: the records produced show account-linking reaching back to 2019, and internal telemetry of a depth Valve has never described.\n\nScope of this section: the observation here is limited to the mechanics of the redaction, measured on the file as produced. The authors' further analysis of the produced logs is withheld pending independent review and is not relied on elsewhere in this dossier.\n\nEvidence: counsel letter of 1 October 2025 and its PDF appendix (SHA-256 recorded in the audit file); page-level PDF measurements and method ↗. The sequence of the request, the page-8 refusal and the characterisation of the exposed records are set out in full in PhishDestroy's account, “My Dog vs. Elite GDPR Lawyers”, 17 August 2026 ↗ archived 2026-08-21 ↗. Account names and third-party data are omitted here; nothing covered by the bars is reproduced.\n\nPage 8 of the covering letter refuses part of the request, and states the reason in writing: Eine genauere Auskunft ist aufgrund des Schutzes der personenbezogenen Daten anderer Nutzer der Steam-Plattform… nicht möglich. — a more detailed answer is not possible, because the personal data of other Steam users must be protected. The 830-page appendix was in the same package. What the bars covered was not account numbers: it was the reports filed against the requester, their authors named, with the raw unredacted messages attached. The account holder had asked Valve, through its counsel, for his own file; what he could extract from it was other people's. Nothing in this appendix turns on who drew the boxes. What it establishes is that the protection Valve invoked as its ground for withholding is the protection this same production failed, in the same envelope, on the same day.\nSupport and Legal Correspondence Exhibits\n\nSource: https://phishdestroy.io/steam_dossier/index#exhibit-gallery-section\n\nAppendix D — Source collection\nSelected primary records\n\nSix records from the archive — three GitHub issues in Valve's trackers and three Reddit accounts of disputed support outcomes. Each source stays attached to the claim, the saved text and the question it raises.\n\n1 / 6 selected records\nChoose a source record\nGH-01 / GITHUBOpen in saved build\nHardware keys, requested in 2016\n\nValveSoftware / steam-for-linux · #4521 · 2016-06-27\n\nA user asked Valve to support U2F hardware keys as an alternative second factor. The saved issue carries both Feature Request and reviewed labels, with its state recorded as open.\n\nI request U2F usb dongle support in steam as an alternative.\n\nExcerpt from the GitHub issue ↗\nDocumented record\nA dated request for an additional account safeguard, published in Valve's own issue tracker and labelled reviewed.\nAccountability demand\nPublish the product decision, the response date and the protection delivered after review.\nRead saved record →Open GitHub ↗\nIn the dossier: Account safeguards →Archive #484 · build 2026-09-17\nGH-02 / GITHUBOpen in saved build\nCrash reports without an effective opt-out\n\nValveSoftware / steam-for-linux · #6459 · 2019-08-18\n\nThe reporter describes a Steam client from 12 August 2019 on Ubuntu 16. They say disabling the crash-upload destination did not persist after a restart, and include the relevant configuration.\n\nIf I disable the `ServerURL`, it gets overwritten after every reboot.\n\nExcerpt from the GitHub issue ↗ archived 2026-04-19 ↗\nDocumented record\nA specific privacy complaint with a client date, operating system and configuration excerpt. The saved issue is open.\nAccountability demand\nIdentify the investigation, the affected builds and the change that made the opt-out effective.\nRead saved record →Open GitHub ↗archived 2026-04-19 ↗\nIn the dossier: Request the underlying records →Archive #467 · build 2026-09-17\nGH-03 / GITHUBOpen in saved build\nAuth-ticket abuse reported to Valve\n\nValveSoftware / Source-1-Games · #3857 · 2022-02-26\n\nThe author alleges that a server operation retained Steam authentication tickets after players disconnected and used misleading server listings. The post asks Valve to address the behavior.\n\nMaking their servers look packed.\n\nExcerpt from the GitHub issue ↗\nDocumented record\nA public abuse report lodged in Valve's tracker on 26 February 2022. Its saved state is open; the report includes links to screenshots.\nAccountability demand\nProduce the investigation result and the mitigation record for the reported authentication-ticket abuse.\nRead saved record →Open GitHub ↗\nIn the dossier: Dataset scope →Archive #768 · build 2026-09-17\nRD-01 / REDDITAuthor's account\n44 disputed Market purchases\n\nr/DotA2 · author handle withheld · 2022-07-07\n\nThe author reports 44 unauthorized Market purchases on 6 July 2022 and roughly $500+ in losses. They say two-factor authentication was enabled and describe repeated template replies from support.\n\n2nd ticket in and I have still yet to receive a non robotic copy paste template response from Steam.\n\nExcerpt from the Reddit post ↗ archived 2025-03-20 ↗\nDocumented record\nA dated account of disputed purchases, with links to transaction screenshots and a support response. The amounts and events are the author's report.\nAccountability demand\nReconcile the disputed purchases with transaction and session logs. Explain the evidence behind support's decision.\nRead saved record →Open Reddit ↗archived 2025-03-20 ↗\nIn the dossier: Support and enforcement →Archive #4,533 · build 2026-09-17\nRD-02 / REDDITAuthor's account\nA permanent ban and closed appeals\n\nr/ohnePixel · author handle withheld · 2024-12-09\n\nThe author disputes a permanent ban and says support cited suspected account transfer and community reports. They describe closed tickets and plans to request their personal data.\n\nI explained my situation and asked for more details, but they're sticking to their decision and closing my tickets.\n\nExcerpt from the Reddit post ↗\nDocumented record\nA preserved appeal account, including the reasons the author says support supplied and links to four images. The post date comes from the selected support export.\nAccountability demand\nIdentify the evidence supporting the permanent ban and the review available to challenge it. Closing an appeal does not explain the decision.\nRead saved record →Open Reddit ↗\nIn the dossier: Request the underlying records →Archive #4,766 · build 2026-09-17\nRD-03 / REDDITAuthor's account\nA recovery reset and a reported $10,000 loss\n\nr/legaladvice · author handle withheld · 2025-05-09\n\nThe author alleges that support reset credentials and disabled account protections after someone else submitted a recovery ticket. They report a loss of about US$10,000 from an inactive account.\n\nSteam Support reset my password and turned off all my account security.\n\nExcerpt from the Reddit post ↗\nDocumented record\nA preserved allegation about the recovery process overriding account safeguards. The saved post records what the author says support told them.\nAccountability demand\nIdentify who authorised the reset, the ownership evidence they accepted and the access log. Account recovery is part of the security system Valve controls.\nRead saved record →Open Reddit ↗\nIn the dossier: Request the underlying records →Archive #4,592 · build 2026-09-17\n\nSix selected records. GitHub states describe the saved build. Reddit posts preserve the authors' accounts.\n\nDownload the six records ↓\n\nThe searchable build contains 16,319 distinct records: 393 Trustpilot, 5,635 Reddit, 2,395 GitHub, 276 web and 7,620 wiki records. Multiple records can concern the same event. The separate 40,448-row master export has a different scope.\n\nSearch the full archive ↗ · Build manifest ↗ · Dataset scope and counts →\n\nAppendix E — Case study\nArchiSteamFarm and the automation clause\n\nAn open-source card-farming tool whose own FAQ states it runs on millions of accounts, set against the Subscriber Agreement clause (§ 4.C) that prohibits automation. The mechanics — what a farm has to buy from Valve before it can produce anything, why every way of cashing out a card breaches the licence, the enforcement record and who moderates the card economy — are set out in full in Exhibit V ↗.\n\nThe Steam Subscriber Agreement, § 4.C, states:\n\n\"You may not use any form of scripts, bots, macros, or other non-human-controlled systems ('Automation') to interact with Content and Services on Steam in any manner.\" — Steam Subscriber Agreement § 4.C (current) ↗ archived 2026-09-18 ↗\n\nValve enforces this clause. It is very good at it. The FAQ of ArchiSteamFarm (ASF) — an open-source tool its own documentation describes as running on more than a few million Steam accounts since a first release over 11 years ago — reproduces three Steam Support messages permanently banning users who ran bot networks. Valve found the networks, named them and killed them. The relevant question is therefore not whether Valve can detect automation at scale.\n\nThe project's official ArchiSteamFarm FAQ addresses the risk of a ban directly:\n\n\"This is extremely unlikely considering the fact that ASF is being used on more than a few million of Steam accounts, since its first release that happened over 11 years ago — but still a possibility, regardless of actual probability.\"\n\n\"Valve clearly acknowledges 'Steam idlers' existing, as stated here, so if you asked me, I'm pretty sure that if they weren't fine with them, they'd already do something instead of pointing out that they could cause problems VAC-wise. The key word here is Steam idlers, for example ASF, and not game idlers.\"\n\n— ArchiSteamFarm FAQ, JustArchiNET. Source: GitHub wiki ↗ · verified verbatim 2026-09-22\n\nThe same FAQ answers \"Did anybody get banned for it?\" with Yes, and reproduces what Steam Support wrote to three of them:\n\n1,000+ bots · trade banned\n\"It looks like this account was used to manage a network of bot accounts. Botting is a violation of the Steam Subscriber Agreement.\"\n\n170+ bots · permanently banned, 2017 Winter Sale\n\"this account was used to illegally collect collectible cards on Steam, as well as related and not only commercial activities. The account has been permanently blocked and Steam Support can not provide additional support on this issue.\"\n\n120+ bots · permanently banned\n\"This and other accounts were used for flooding our network infrastructure, which is a violation of Steam online conduct.\"\n\n— Steam Support messages reproduced in the ArchiSteamFarm FAQ, section \"Did anybody get banned for it?\". Source ↗ · verified verbatim 2026-09-22\n\nPut the two records side by side. A private user with 1,000 farming bots is identified, told that \"botting is a violation of the Steam Subscriber Agreement\", and permanently removed. The commercial platforms in this dossier run automated Steam accounts as their core business, at far greater scale, and authenticate through Valve's own OpenID on every login — and no per-operator enforcement record has been published for any of them. The clause works. The question is who it is pointed at.\n\nASF is not accused of anything here, and its reading of Valve's position is its own — its author states plainly that \"ASF is not authorized by Valve\". The tool is used here as a measuring instrument: it shows that Valve detects bot networks, names them in writing and bans them permanently. Valve can close the question in one sentence by publishing which commercial automation it authorises, and the per-operator record of what it did about the rest.\n\nWhere card farming touches Valve's revenue\n\nFarmed trading cards are sold on the Steam Community Market, which charges a combined fee of about 15% on each sale completed inside the Market; the account must have spent $5.00 USD on Steam before it can receive a card at all; and card drops require game ownership or in-game purchases. No aggregate revenue figure is estimated here — the operating scale is stated only as the ASF FAQ states it. The FAQ also records Valve distinguishing \"Steam idlers\" (card farming) from \"game idlers\"; see the ASF FAQ ↗. The mechanics are set out in full in Exhibit V — the scale and the commercial-use trap.\n\nSubjectArchiSteamFarm — automated card farming\nStated scaleMillions of accounts (per ASF FAQ — exact active count unverified)\nCounted, not quoted10,880,610 total API entries in ASF's own Steam group (5,360,499 non-limited, as Steam displays) — the FAQ's \"millions\" is not a story, it is a headcount. 88.97% carry no Steam ban of any kind. The full ban census ↗\nDisclosures in the tool's own documentation\nASF logs accounts in headlessly and idles games for card drops without launching the Steam client (per the project documentation).\nThe FAQ reasons that Valve is aware of \"Steam idlers\" and that \"if they weren't fine with them, they'd already do something\".\nNo targeted enforcement reported in over 11 years (per the FAQ); the resulting card sales inside the Community Market carry Steam's combined fee of about 15%.\nThe FAQ states a recommended ceiling of ten accounts per operator and attributes it to Valve: \"This recommendation is based on internal Valve guidelines, as well as our own suggestions.\" No such guideline is published by Valve.\nTechnical ceiling, per the same FAQ: \"you can run up to 100-200 bots with a single IP and a single ASF instance.\"\nFarmed playtime is recorded by Valve — \"it's usually updated every 30 minutes or so\" — and § 4.C lists \"Faking gameplay statistics (e.g., inflated wins or losses, XP, playtime)\" as a prohibited act.\nSources\nOfficial JustArchi ASF FAQ wiki ↗ ArchiSteamFarm repository ↗ archived 2026-09-24 ↗\nThe automation clause is explicit; the ASF FAQ has stated for years that the tool runs on millions of accounts; no targeted enforcement against it has been reported. The gap between the rule and its application is the record; the reason for it is not established here.\nFull exhibitThe card economy: the process, the scale, the licence and who moderates it ↗What a farm has to buy from Valve before it can produce a single card; the two lines of § 4.C that name card farming by its effects; why every way of cashing a card out breaches the licence Valve wrote while Valve charges a fee at the door; the enforcement record including the June 2025 VAC wave and chain-banning by shared phone number; and the Valve employee and community moderators found administering the card-trading and ban-list services around Steam.The ban censusWe didn't ask Valve how big the farm is. We counted it. ↗10,880,610 total accounts (limited and non-limited) read from ArchiSteamFarm's own Steam group, which the software auto-joins by default on first launch unless the user unchecks the group-join setting (capturing both commercial bot farms and regular players who left the default on). 88.97% carry no Steam ban of any kind; of the 11% that do, 99.8% are cosmetic community bans that never stop trading. Cross-checked against SteamRep, 67.77% of listed scammers walk free once anti-cheat bans are set aside. With registration-date, geography and survival breakdowns — the real scale, measured, not narrated.\n\nAppendix F — Working ledger\n\nRules ledger: clauses against recorded platforms\n\nChoose a rule; the register lists the recorded platforms tagged under it, with their main domain, declared auth host and saved Link Filter result. A blocked website, another domain for sign-in: follow the rule through to the route that remains.\n\n175records linked\nto this rule\n174 primary domains0 C&D mentions\nRULE EXCERPT / SSA § 2.G\nCommercial Use & Account Charging\n“…exploit the Content and Services or any of its parts for any commercial purpose, except as expressly permitted elsewhere in this Agreement (including any Subscription Terms or Rules of Use).”\nFOLLOW THE RECORDS\nPlatform register 175\nScale figures are source estimates\n\n175 of 175 records\n\nService / parent group\tMain domain / registry\tObserved auth domain / age\tScale / recorded response\n\nCasino\n\tcsgoempire.com\n11.3 yearsRegistered 2015-06-10\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ncsgoempirelogin4.com\n6.2 yearsRegistered 2020-07-20\nRDAP ↗\nSEPARATE DOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Roulette\n\trustreaper.com\n23.2 yearsRegistered 2003-06-24\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nrustreaper.com\n23.2 yearsRegistered 2003-06-24\nRDAP ↗\nSAME HOSTSame hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Casino\n\trustly.com\n12.4 yearsRegistered 2014-05-06\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nrustly.com\n12.4 yearsRegistered 2014-05-06\nRDAP ↗\nSAME HOSTSame hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRoulette Casino\n\tcsgofast.com\n11.5 yearsRegistered 2015-03-27\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nsteam-login.authtofast.com\n83 daysRegistered 2026-06-30\nRDAP ↗ · authtofast.com (parent)\nSEPARATE DOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCrypto Casino\n\tduelbits.com\n6.6 yearsRegistered 2020-02-03\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nswitchflips.com\n6.4 yearsRegistered 2020-04-21\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opener\n\tfarmskins.com\n10.5 yearsRegistered 2016-03-23\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nsteam.kobal.cc\n9.7 yearsRegistered 2017-01-07\nRDAP ↗ · kobal.cc (parent)\nSEPARATE DOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tcsgoluck.com\n9.3 yearsRegistered 2017-05-18\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ncsgoluck.com\n9.3 yearsRegistered 2017-05-18\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Roulette\n\tinsane.gg\n7.5 yearsRegistered 2019-04-02\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.insane.gg\nRegistry date unavailableRegistry date unavailable\nOWN SUBDOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tcs2skin.com\n3.5 yearsRegistered 2023-03-06\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ncs2skin.com\n3.5 yearsRegistered 2023-03-06\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tjuice.gg\n7.9 yearsRegistered 2018-10-19\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nletmeinjuice.com\n2.4 yearsRegistered 2024-04-15\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\tggdrop.com\n8.6 yearsRegistered 2018-02-23\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nggauth.com\n3.4 yearsRegistered 2023-05-03\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkins Casino\n\thowl.gg\n9.5 yearsRegistered 2017-03-16\nWHOISFREAKS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nhowl.uno\n41 daysRegistered 2026-08-11\nRDAP ↗\nSEPARATE DOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tchicken.gg\n5.7 yearsRegistered 2021-01-11\nWHOISFREAKS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nchicken.gg\n5.7 yearsRegistered 2021-01-11\nWHOISFREAKS ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tcsgocasino.gg\n2.6 yearsRegistered 2024-02-17\nWHOISFREAKS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.csgocasino.gg\n2.6 yearsRegistered 2024-02-17\nWHOISFREAKS ↗ · csgocasino.gg (parent)\nOWN SUBDOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkins Casino\n\thunt.gg\n6.9 yearsRegistered 2019-11-04\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.hunt.gg\nRegistry date unavailableRegistry date unavailable\nOWN SUBDOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Battles\n\tcsbattle.com\n9.8 yearsRegistered 2016-12-10\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ncsbattle.com\n9.8 yearsRegistered 2016-12-10\nRDAP ↗\nSAME HOSTSame hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tskinrave.gg\n3.1 yearsRegistered 2023-08-16\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.skinrave.gg\nRegistry date unavailableRegistry date unavailable\nOWN SUBDOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tcsdouble.gg\n261 daysRegistered 2026-01-03\nWHOISFREAKS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ncsdouble.gg\n261 daysRegistered 2026-01-03\nWHOISFREAKS ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Roulette\n\trustchance.com\n8.0 yearsRegistered 2018-10-03\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nhgfuihd.com\n7.6 yearsRegistered 2019-01-27\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Automation\n\tcobaltlab.tech\n3.5 yearsRegistered 2023-03-30\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ncobaltauth.com\n1.7 yearsRegistered 2025-01-07\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Roulette\n\traided.gg\n171 daysRegistered 2026-04-03\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.raided.gg\n171 daysRegistered 2026-04-03\nIP2WHOIS ↗ · raided.gg (parent)\nOWN SUBDOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Casino\n\trustneo.gg\n1.3 yearsRegistered 2025-06-20\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nrustneo.gg\n1.3 yearsRegistered 2025-06-20\nIP2WHOIS ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tsplits.gg\n3.7 yearsRegistered 2023-01-23\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nsplits.gg\n3.7 yearsRegistered 2023-01-23\nIP2WHOIS ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Upgrader\n\tupgrader.pro\n1.2 yearsRegistered 2025-07-02\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nupgauth.space\n38 daysRegistered 2026-08-14\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tskin.fans\n8.2 yearsRegistered 2018-07-13\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nauth.skinfans.com\nRegistry date unavailableRegistry date unavailable\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\thotpizza.one\n1.8 yearsRegistered 2024-12-07\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nhotpizza.one\n1.8 yearsRegistered 2024-12-07\nRDAP ↗\nSAME HOSTSame hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\tg4skins.com\n10.1 yearsRegistered 2016-08-09\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nauth.g4s.to\nRegistry date unavailableRegistry date unavailable\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTF2 Gambling\n\ttf2royal.com\n4.1 yearsRegistered 2022-08-17\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ntf2auth.com\n5.2 yearsRegistered 2021-07-27\nRDAP ↗\nSEPARATE DOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTF2 Gambling\n\ttf2hunt.com\n8.7 yearsRegistered 2018-01-13\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nrstspcl.com\n6.1 yearsRegistered 2020-08-08\nRDAP ↗\nSEPARATE DOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTF2 Gambling\n\ttf2.bet/coinflip\n8.4 yearsRegistered 2018-05-06\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ntf2.bet\n8.4 yearsRegistered 2018-05-06\nRDAP ↗\nSAME HOSTSame hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\topenstars.gg\n131 daysRegistered 2026-05-13\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nopenstars.gg\n131 daysRegistered 2026-05-13\nIP2WHOIS ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCS2 Market\n\tskins.com\n25.1 yearsRegistered 2001-08-08\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.skins.com\n25.1 yearsRegistered 2001-08-08\nRDAP ↗ · skins.com (parent)\nOWN SUBDOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nP2P Market\n\twhite.market\n9.6 yearsRegistered 2017-03-01\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nwhite.market\n9.6 yearsRegistered 2017-03-01\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nP2P Market\n\tmoon.market\n7.6 yearsRegistered 2019-02-27\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nmoon.market\n7.6 yearsRegistered 2019-02-27\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nP2P Market\n\tcsfloat.com\n5.2 yearsRegistered 2021-07-11\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ncsgofloat.com\n11.0 yearsRegistered 2015-09-29\nRDAP ↗\nSEPARATE DOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkins Market\n\tskin.land\n4.7 yearsRegistered 2022-01-21\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nauth.skin.land\nRegistry date unavailableRegistry date unavailable\nOWN SUBDOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkins Market\n\thaloskins.com\n2.8 yearsRegistered 2023-12-10\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nhaloskins.com\n2.8 yearsRegistered 2023-12-10\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCorporate Market\n\tbuff.163.com\n29.0 yearsRegistered 1997-09-15\nRDAP ↗ · 163.com (parent)\nOpen Steam Link Filter ↗Filter status is a separate check\t\nbuff.163.com\n29.0 yearsRegistered 1997-09-15\nRDAP ↗ · 163.com (parent)\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nP2P Marketplace\n\tmarket.csgo.com\n26.6 yearsRegistered 2000-02-07\nRDAP ↗ · csgo.com (parent)\nOpen Steam Link Filter ↗Filter status is a separate check\t\ndota2.net\n14.9 yearsRegistered 2011-10-29\nRDAP ↗\nSEPARATE DOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRegulated Market\n\tskinport.com\n8.0 yearsRegistered 2018-09-05\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nskinport.app\n6.3 yearsRegistered 2020-06-20\nRDAP ↗\nSEPARATE DOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nMarketplace/Swap\n\tskinflow.gg\n3.8 yearsRegistered 2022-11-26\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.skinflow.gg\nRegistry date unavailableRegistry date unavailable\nOWN SUBDOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkins Market\n\tskin.place\n6.0 yearsRegistered 2020-09-23\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.skin.place\nRegistry date unavailableRegistry date unavailable\nOWN SUBDOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nInstant Swap\n\tskinsmonkey.com\n5.7 yearsRegistered 2021-01-06\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nskinsmonkey.com\n5.7 yearsRegistered 2021-01-06\nRDAP ↗\nSAME HOSTSame hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCorporate Market\n\tskinbaron.de\nRegistry date unavailableRegistry date unavailable\nOpen Steam Link Filter ↗Filter status is a separate check\t\nskinbaron.com\n10.7 yearsRegistered 2015-12-22\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Market\n\trust.tm\nRegistry date unavailableRegistry date unavailable\nOpen Steam Link Filter ↗Filter status is a separate check\t\ndota2.net\n14.9 yearsRegistered 2011-10-29\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nInstant Swap\n\tpirateswap.com\n6.0 yearsRegistered 2020-09-22\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nlogin.pirateswap.com\n6.0 yearsRegistered 2020-09-22\nRDAP ↗ · pirateswap.com (parent)\nOWN SUBDOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTF2 Marketplace\n\tmannco.store\n8.6 yearsRegistered 2018-03-02\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nmannco.store\n8.6 yearsRegistered 2018-03-02\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nInstant Swap\n\tskinswap.com\n9.9 yearsRegistered 2016-11-14\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.skinswap.com\nRegistry date unavailableRegistry date unavailable\nOWN SUBDOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nP2P Market\n\texeskins.com\n2.1 yearsRegistered 2024-08-14\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nexeskins.com\n2.1 yearsRegistered 2024-08-14\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkins Market\n\tbalticskins.com\n153 daysRegistered 2026-04-21\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nbalticskins.com\n153 daysRegistered 2026-04-21\nRDAP ↗\nSAME HOSTSame hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nInstant Swap\n\tcs.trade\n8.9 yearsRegistered 2017-11-14\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ncs.trade\n8.9 yearsRegistered 2017-11-14\nRDAP ↗\nSAME HOSTSame hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCS2 Market\n\trapidskins.com\n4.5 yearsRegistered 2022-03-11\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.rapidskins.com\n4.5 yearsRegistered 2022-03-11\nRDAP ↗ · rapidskins.com (parent)\nOWN SUBDOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCS2 Market\n\ttradeit.gg\n9.1 yearsRegistered 2017-08-21\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nconnect-tradeit.com\n4.6 yearsRegistered 2022-02-23\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCS2 Market\n\t49skins.com\n3.4 yearsRegistered 2023-04-19\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.49skins.com\n3.4 yearsRegistered 2023-04-19\nRDAP ↗ · 49skins.com (parent)\nOWN SUBDOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCS2 Market\n\tskinvault.gg\n3.4 yearsRegistered 2023-05-06\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.skinvault.gg\n3.4 yearsRegistered 2023-05-06\nIP2WHOIS ↗ · skinvault.gg (parent)\nOWN SUBDOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkins Trading\n\taim.market\n3.3 yearsRegistered 2023-05-22\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\naim.market\n3.3 yearsRegistered 2023-05-22\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nInstant Sell Portal\n\tskinout.gg\n5.6 yearsRegistered 2021-02-27\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nauth.skinout.gg\n5.6 yearsRegistered 2021-02-27\nIP2WHOIS ↗ · skinout.gg (parent)\nOWN SUBDOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkins Trading\n\tntskins.com\n230 daysRegistered 2026-02-03\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nntskins.com\n230 daysRegistered 2026-02-03\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nP2P Portal\n\tgamerpay.gg\n6.0 yearsRegistered 2020-10-02\nWHOISFREAKS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ngamerpay.gg\n6.0 yearsRegistered 2020-10-02\nWHOISFREAKS ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTF2 Scrap Swap\n\tscrap.tf\n14.0 yearsRegistered 2012-09-03\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nscrap.tf\n14.0 yearsRegistered 2012-09-03\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTF2 Cashout\n\tmarketplace.tf\n14.0 yearsRegistered 2012-09-19\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nmarketplace.tf\n14.0 yearsRegistered 2012-09-19\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nInstant Cashout\n\tskins.cash\n10.5 yearsRegistered 2016-03-30\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nskinscash.live\n6.8 yearsRegistered 2019-12-05\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\tcsgo.net\n14.2 yearsRegistered 2012-07-22\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\ncn2.easylot.net\n10.0 yearsRegistered 2016-09-03\nRDAP ↗ · easylot.net (parent)\nSEPARATE DOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCommunity Hub\n\tcybershoke.net\n6.8 yearsRegistered 2019-11-18\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nauth.cybershoke.net\nRegistry date unavailableRegistry date unavailable\nOWN SUBDOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nMatchmaker Hub\n\tfastcup.net\n14.6 yearsRegistered 2012-02-16\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.fastcup.net\n14.6 yearsRegistered 2012-02-16\nRDAP ↗ · fastcup.net (parent)\nOWN SUBDOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSaaS Analytics\n\tleetify.com\n7.6 yearsRegistered 2019-03-01\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nleetify.com\n7.6 yearsRegistered 2019-03-01\nRDAP ↗\nSAME HOSTSame hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSaaS Analytics\n\tscope.gg\n7.8 yearsRegistered 2018-12-10\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nscope.gg\n7.8 yearsRegistered 2018-12-10\nIP2WHOIS ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSaaS Tools\n\ttradeupspy.com\n6.5 yearsRegistered 2020-03-11\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.tradeupspy.com\nRegistry date unavailableRegistry date unavailable\nOWN SUBDOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nMarketplace\n\tcs.deals\n9.8 yearsRegistered 2016-12-03\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\napi.cs.deals\n9.8 yearsRegistered 2016-12-03\nRDAP ↗ · cs.deals (parent)\nOWN SUBDOMAINReturn hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSaaS Price DB\n\tpricempire.com\n6.6 yearsRegistered 2020-01-30\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\npricempire.com\n6.6 yearsRegistered 2020-01-30\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nMass Blackmarket\n\tFSB Market\n7.2 yearsRegistered 2019-07-27\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nFSB Market\n7.2 yearsRegistered 2019-07-27\nRDAP ↗\nSAME HOSTSame hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nReady-Account Hub\n\tz2u.com\n26.9 yearsRegistered 1999-11-10\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nwww.z2u.com\n26.9 yearsRegistered 1999-11-10\nRDAP ↗ · z2u.com (parent)\nSAME HOSTSame hostname captured2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Gambling\n\tcsgoroll.com\n11.6 yearsRegistered 2015-02-03\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nwww.csgoroll.com\nRegistry date unavailableRegistry date unavailable\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCrypto Casino\n\trollbit.com\n11.9 yearsRegistered 2014-11-08\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nrbsnin.com\n3 daysRegistered 2026-09-18\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nLicenced Casino\n\t500.casino\n5.9 yearsRegistered 2020-11-08\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRoulette/Slots\n\tcsgobig.com\n11.4 yearsRegistered 2015-04-12\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\tcasedrop.com\n14.8 yearsRegistered 2011-12-16\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Casino\n\tbanditcamp.com\n12.2 yearsRegistered 2014-06-27\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\tskinbox.com\n18.8 yearsRegistered 2007-12-20\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\ttastydrop.com\n6.1 yearsRegistered 2020-08-29\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRoulette Casino\n\tcsgopolygon.gg\n6.5 yearsRegistered 2020-03-28\nWHOISFREAKS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite did not load2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\tmagicdrop.ru\n10.3 yearsRegistered 2016-05-16\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedConsent required2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nDice Casino\n\tcsdice.com\n3.8 yearsRegistered 2022-11-23\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite did not load2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nUpgrader Casino\n\tskinodds.com\n1.2 yearsRegistered 2025-06-26\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Roulette\n\tcsgowin.com\n12.0 yearsRegistered 2014-09-18\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCrash Casino\n\tcsgorun.net\n7.3 yearsRegistered 2019-06-11\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\topenskins.com\n3.6 yearsRegistered 2023-02-26\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Gambling\n\trustbet.com\n7.6 yearsRegistered 2019-02-07\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedConsent required2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Roulette\n\tcsgomagic.com\n9.4 yearsRegistered 2017-05-01\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite did not load2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nUpgrader/Contract\n\tcsgobounty.com\n11.5 yearsRegistered 2015-03-26\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Roulette\n\tezskins.com\n27.5 yearsRegistered 1999-03-11\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\trustcases.com\n7.2 yearsRegistered 2019-06-22\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedConsent required2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Roulette\n\tcsgoreaper.com\n11.1 yearsRegistered 2015-08-21\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tcsgocases.com\n12.3 yearsRegistered 2014-06-08\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Upgrader\n\tcsgo-skins.com\n11.2 yearsRegistered 2015-07-27\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\tcsgonet.com\n8.8 yearsRegistered 2017-12-05\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Roulette\n\twtfskins.com\n9.0 yearsRegistered 2017-10-06\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Casino\n\tflamecases.com\n10.0 yearsRegistered 2016-09-18\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCrypto Casino\n\tgamedom.com\n11.7 yearsRegistered 2015-01-21\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Battles\n\tskin.club\n9.0 yearsRegistered 2017-09-04\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nsc-auth.net\n7.5 yearsRegistered 2019-04-02\nRDAP ↗\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\tdaddyskins.com\n9.9 yearsRegistered 2016-10-19\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedConsent required2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Gambling\n\trustix.gg\n1.7 yearsRegistered 2025-01-16\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Upgrade\n\tskins.club\n4.2 yearsRegistered 2022-07-10\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Roulette\n\tcsgohouse.org\n146 daysRegistered 2026-04-28\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedConsent required2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tskinrave.net\n216 daysRegistered 2026-02-17\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\tbloodycase.gg\n19 daysRegistered 2026-09-02\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nClicker/Upgrade\n\tcsgoclicker.com\n8.3 yearsRegistered 2018-05-17\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Roulette\n\trustbet.gg\n4.0 yearsRegistered 2022-09-30\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\tcs-drop.com\n262 daysRegistered 2026-01-02\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Roulette\n\thellstore.net\n11.7 yearsRegistered 2015-01-11\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Casino\n\trustloot.com\n354 daysRegistered 2025-10-02\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCase Opening\n\tcsgo-case.com\n10.3 yearsRegistered 2016-05-16\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Casino\n\tcsgogem.com\n9.9 yearsRegistered 2016-10-16\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCrypto Casino\n\trainbet.com\n8.8 yearsRegistered 2017-11-26\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nservices.rainbet.com\nRegistry date unavailableRegistry date unavailable\nOWN SUBDOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Casino\n\trustclash.com\n5.4 yearsRegistered 2021-05-09\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCrash Casino\n\t12cs.fail\n181 daysRegistered 2026-03-24\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTF2 Gambling\n\twww.tf2easy.com\n6.3 yearsRegistered 2020-06-02\nRDAP ↗ · tf2easy.com (parent)\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTF2 Gambling\n\ttf2blaze.com\n7.6 yearsRegistered 2019-01-28\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCrypto Casino\n\tshuffle.com\n30.1 yearsRegistered 1996-07-31\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCS2 Market\n\tbuff.market\n5.9 yearsRegistered 2020-10-10\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCS2 Market\n\tavan.market\n8.3 yearsRegistered 2018-05-21\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTrading Engine\n\tcs.money\n11.0 yearsRegistered 2015-09-16\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nauth.dota.trade\nRegistry date unavailableRegistry date unavailable\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nP2P Market\n\tuuskins.com\n2.6 yearsRegistered 2024-01-29\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nMass Market\n\tyoupin898.com\n6.1 yearsRegistered 2020-08-27\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCS2 Market\n\tc5game.com\n10.5 yearsRegistered 2016-03-20\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nP2P Marketplace\n\twaxpeer.com\n7.3 yearsRegistered 2019-05-20\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nwaxpeer.com\n7.3 yearsRegistered 2019-05-20\nRDAP ↗\nSAME HOSTHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nBot Trading\n\tcs.money\n11.0 yearsRegistered 2015-09-16\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nauth.dota.trade\nRegistry date unavailableRegistry date unavailable\nSEPARATE DOMAINHost in supplied OpenID URL2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nUS Marketplace\n\tdmarket.com\n30.2 yearsRegistered 1996-07-03\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nOfficial Market\n\tsteamcommunity.com/market\n20.3 yearsRegistered 2006-05-28\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNot an external login site2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTrading Platform\n\tlootfarm.com\n11.9 yearsRegistered 2014-10-22\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite did not load2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRust Market\n\trustskins.com\n7.6 yearsRegistered 2019-01-31\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCS2 Market\n\tkrakatoa.com\n26.4 yearsRegistered 2000-05-15\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nP2P Marketplace\n\tshadowpay.com\n10.1 yearsRegistered 2016-08-06\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nChinese Powerhouse\n\tigxe.cn\n15.0 yearsRegistered 2011-09-06\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nAutomated Swap\n\tswap.gg\n9.6 yearsRegistered 2017-01-29\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCash-out Portal\n\tbitskins.com\n11.2 yearsRegistered 2015-07-21\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTF2 Automation\n\ttf2mart.com\n1.1 yearsRegistered 2025-08-06\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Auctions\n\tskinbid.com\n10.2 yearsRegistered 2016-06-29\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSkin Rental\n\tlootbear.com\n8.7 yearsRegistered 2018-01-16\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTF2 Valuation\n\tbackpack.tf\n14.4 yearsRegistered 2012-05-09\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTF2 Botnet\n\tstntrading.eu\nRegistry date unavailableRegistry date unavailable\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nInstant Cashout\n\tskinwallet.com\n18.0 yearsRegistered 2008-09-14\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nDota 2 Market\n\tdota2market.com\n12.2 yearsRegistered 2014-07-24\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nServer Network\n\txplay.gg\n5.3 yearsRegistered 2021-06-13\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nMatchmaking Portal\n\tesportal.com\n26.8 yearsRegistered 1999-12-20\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nLATAM Hub\n\tgamersclub.com.br\n11.2 yearsRegistered 2015-06-29\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSaaS Tools\n\tepidemic.gg\n4.9 yearsRegistered 2021-11-03\nWHOISFREAKS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSaaS Index\n\tcs2stash.com\n3.5 yearsRegistered 2023-03-05\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite did not load2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSaaS Index\n\tcsgoskins.gg\n6.8 yearsRegistered 2019-12-21\nWHOISFREAKS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSaaS Index\n\tsteamanalyst.com\n12.6 yearsRegistered 2014-02-21\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nTrading Exchange\n\tsteamcardexchange.net\n13.3 yearsRegistered 2013-05-22\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSaaS Tracker\n\tdotabuff.com\n14.2 yearsRegistered 2012-06-22\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSaaS Tracker\n\ttracker.gg\n8.9 yearsRegistered 2017-10-12\nIP2WHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nAccount Exchange\n\tfunpay.com\n17.0 yearsRegistered 2009-09-06\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nGrey Market\n\tplayerauctions.com\n26.3 yearsRegistered 2000-06-13\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nAccount Portal\n\teldorado.gg\n8.0 yearsRegistered 2018-09-12\nWHOISFREAKS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nMass Key Market\n\tg2a.com\n24.8 yearsRegistered 2001-12-09\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite did not load2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nMass Key Market\n\tkinguin.net\n16.8 yearsRegistered 2009-12-17\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nVirtual Services\n\tg2g.com\n31.1 yearsRegistered 1995-08-10\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nAccount Broker\n\tplayerup.com\n19.3 yearsRegistered 2007-05-30\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSmurf Shop\n\tsmurfhub.net\n2.7 yearsRegistered 2023-12-26\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite did not load2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSmurf Shop\n\tsmurfaccounts.com\n5.3 yearsRegistered 2021-05-18\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedVerification challenge2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRank Shop\n\tbuycsgorank.com\n6.2 yearsRegistered 2020-07-09\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSmurf Shop\n\tcsgosmurfkings.com\n9.3 yearsRegistered 2017-06-08\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite did not load2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nSmurf Shop\n\tsmurfstore.co\n8.6 yearsRegistered 2018-03-03\nWHOIS ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCard Leveling\n\tsteamlvlup.com\n9.9 yearsRegistered 2016-11-10\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCard Leveling\n\tsteamlevels.com\n10.6 yearsRegistered 2016-02-19\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite returned an error2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCard Leveling\n\tlevelsteam.com\n79 daysRegistered 2026-07-04\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedCheck timed out2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nCard Leveling\n\tsteamlevelu.com\n6.0 yearsRegistered 2020-09-05\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRank Boosting\n\teloking.com\n12.2 yearsRegistered 2014-07-02\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRank Boosting\n\tboosteria.org\n11.9 yearsRegistered 2014-10-20\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite did not load2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nBoosting SaaS\n\tovergear.com\n14.4 yearsRegistered 2012-04-20\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedLogin not resolved2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nBoosting SaaS\n\tblazingboost.com\n14.2 yearsRegistered 2012-06-23\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nRank Boosting\n\tdota2boost.com\n2.9 yearsRegistered 2023-10-11\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedWebsite did not load2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\n\nBoosting SaaS\n\tbuyboost.com\n22.4 yearsRegistered 2004-04-30\nRDAP ↗\nOpen Steam Link Filter ↗Filter status is a separate check\t\nRoute not confirmedNo visible Steam sign-in2026-09-19 · capture ↗\n\tNo sourced measurementSee dated evidence\nThe investigation’s argumentSelected rule / analysis & commentary+\nBurden of proof\n\nThe investigation challenges the gap between restrictions on commercial use and the services recorded here. Classify each activity and establish any express permission before calling it a contractual violation. Community Market fees do not apply to every external trade.\n\nWhat a tagged record is, and is not\n\nA record is tagged when the dossier holds a dated observation that brings the platform within the clause on its face. A tag is not an adjudicated violation, and no express Valve permission has been produced on the record for any platform listed here. Where a platform holds an authorisation, publishing it resolves the entry.\n\nSources & methodologyEstimates, definitions & scope+\n\nCounts above refer to the selected rule. Record types group each platform once; full tags appear in the platform details. Search and filters apply within that rule. Registration dates come from the saved RDAP / WHOIS snapshot. Subdomains use the parent domain’s creation date. Age alone does not establish continuous operation or an authentication route. Current auth hostnames come from saved OpenID requests, with a UTC timestamp; unresolved checks do not reuse legacy labels. The observer stops before Steam login and does not test Steam Link Filter status. Download route observations ↗ Download registry results ↗\n\nExplore the source archive ↗\nAppendix G — From a template refusal to the underlying record\nDSAR playbook: request the evidence\n\nUse Article 15 GDPR to request personal data relating to API-key creation, account recovery and support access. A retained record can test who initiated an action and what the platform relied on.\n\n01\nPreserve your timeline.\n\nSave account notices, tickets, trade IDs and dates in UTC. Secure the account and review the recovery options applicable to the game and transaction.\n\nSteam Trade Protection information ↗\n02\nRequest your retained data.\n\nAsk for timestamps, source IPs, key lifecycle events, security confirmations and account-related recovery actions. Include support-access events and recipients where those data concern you.\n\n03\nKeep the delivery record.\n\nUse Valve's privacy contact route. The usual response period is one month; a necessary extension of up to two further months must be explained within that first month.\n\nValve privacy contact route ↗ archived 2026-09-21 ↗\n04\nCompare the response.\n\nReconcile logs with your timeline. Ask for reasons for omissions, then use the supervisory-authority complaint route if necessary. Preserve the response exactly as received.\n\nScope / Article 15\n\nAccess covers retained personal data, including data in logs. It does not guarantee every internal document, reconstructed records or unredacted data about others. Ask for an intelligible copy and the basis for any restriction.\n\nEDPB access guidelines, §§ 2, 4–6 ↗ · GDPR Articles 12, 15, 77 ↗ archived 2026-09-20 ↗\n\nData subject access requestGDPR / Article 15\nAccount security & access records\n\nReplace the bracketed fields before submitting.\n\nTo: Valve Privacy Team\nSubject: Article 15 GDPR request — account security records\n\nAccount / SteamID: [YOUR ACCOUNT IDENTIFIER]\nRelevant period (UTC): [START] to [END]\nRelated support tickets: [TICKET REFERENCES]\n\nI request a copy of the personal data concerning me that you retain for this period, including:\n\n1. API-key registration, confirmation, use and revocation events, with available timestamps, source IP addresses, registered domains, device or user-agent information and non-secret key identifiers.\n\n2. Recorded account-recovery actions, password/email/phone changes, Steam Guard removals or resets, confirmation events and the account-related evidence relied on to authorize those actions.\n\n3. Personal data in support-access and administrative-action logs concerning my account, including available dates, purposes, actions and the support entity involved, subject to applicable rights of others.\n\n4. Account-related records used to determine any sanction, and available records of my complaints, reviews and responses.\n\nPlease also provide the applicable processing purposes, categories, recipients, retention periods or criteria, and available information about sources where data were not obtained from me.\n\nWhere processing relies on my consent, please provide the retained record of the consent relied upon and the wording presented at that time.\n\nPlease provide an intelligible electronic copy with time zones and field definitions. Please do not include active credentials or secret tokens. If any requested data are not held, please say so. For any withheld data, please identify the scope and legal basis of the restriction and provide the remainder.\n\nPlease acknowledge receipt and respond within the applicable Article 12 period, explaining any necessary extension. I also ask you to preserve relevant existing records while this request is handled.\n\nName: [YOUR NAME]\nDate: [DATE]\nWhat a data-centre IP can establish\nA discrepancy is evidence to investigate.\n\nAn API-key request originating from a data-centre network, as in the hosting-provider example raised in this investigation, can be relevant when compared with login records, confirmations and the user's timeline. An IP alone does not identify the actor or automatically defeat every defence. Evidence that a hostile actor supplied the recorded consent could challenge reliance on that consent; other legal bases and liability issues require separate analysis.\n\nSee the preserved ban-and-GDPR complaint →\nAppendix H — Wayback Machine archive analysis · published support statistics\nSupport volume. Published response times.\nContext & source limits\n\nValve publishes daily support statistics at store.steampowered.com/stats/support. Wayback Machine archives preserve historical snapshots of this page from 2018 to 2026. The volume-to-headcount ratio implied by these figures is inconsistent with per-ticket human review at the published response times.\n\nCompare Valve's archived support figures across the saved snapshots. The methodology explains what those figures can and cannot measure.\n\nVolume against published response time (2018 → 2026)\nTwo queues at one support desk, read across 21 archived captures.\n\nValve publishes live support figures at store.steampowered.com/stats/support. Each point below is the lower bound Valve itself printed on that page on the day the Internet Archive captured it — not an estimate of ours. Both series are the same measure in the same unit, so they belong on one axis and can be read against each other directly.\n\nRefund requests — money Valve is holdingAccount security & recovery — the account you have lost\n0 h\n2 h\n4 h\n6 h\n8 h\n10 h\nno captures · 38 months\n2019\n2020\n2021\n2022\n2023\n2024\n2025\n2026\n8 h 44 m\naccount recovery\n52 m\nrefunds\n15 m — one capture only\n49–55 minThe refund lower bound in every capture from February 2018 to August 2026. Across eight and a half years it moves by under six minutes, while daily refund volume moves by a factor of nine.\n2.4 h → 8.7 hThe account-recovery lower bound sits near 2.4 hours in every capture through December 2022 but one. In the three 2026 captures Valve publishes 10.9 h, 5.8 h and 8.7 h.\n×2.8 → ×13How much slower recovery is than refunds, by Valve's own published figures. Steady for five years, then it widens — the queue that got slower is the one where the user, not Valve, is out of pocket.\n\nSource: 21 Wayback Machine captures of store.steampowered.com/stats/support, 2018-02-03 to 2026-08-10; extraction in VALVE_EVIDENCE_PACK/databases/steam_support_stats_history.json. Read the limits with the figures: the chart plots the lower bound of the range Valve prints. The published upper bound is worse on both lines — refunds ranged 1.5 hours to 1.5 days, recovery 7.0 hours to 3.6 days. Two captures were archived in a localised edition of the same Valve page — 2018-11-03 in Czech, 2020-03-25 in French — and are marked (cs) and (fr) in the table; their figures appear here with the unit words translated and the numbers as published, and the verbatim source strings are kept in the extraction file. Every capture published a response time for both queues, and no point on either line is interpolated. The single 15-minute recovery figure of 2020-10-21 is flagged on the chart and left in: it appears in one capture only and no other capture is within an order of magnitude of it. No capture exists between 2022-12-08 and 2026-02-01; that 38-month hole in the record is shaded, and nothing is drawn across it. These figures describe published response times. They do not show what happens inside a ticket, and Valve has published no headcount against which to read them.\n\nOpen every capture as a table\nEvery archived capture, as published\nCapture\tRefunds / day\tRefund response\tRecovery / day\tRecovery response\n2018-02-03\t98,788\t50.12 minutes to 1.52 hours\t25,662\t2.51 hours to 1.80 days\n2018-05-07\t60,494\t53.83 minutes to 1.47 days\t24,226\t2.45 hours to 2.22 days\n2018-08-02\t69,084\t50.27 minutes to 1.59 hours\t28,953\t2.44 hours to 22.17 hours\n2018-11-03 (cs)\t63,410\t49.28 minutes to 1.54 hours\t33,910\t2.42 hours to 1.31 days\n2019-02-01\t76,305\t50.13 minutes to 1.52 hours\t35,164\t2.44 hours to 2.04 days\n2019-05-18\t78,951\t51.03 minutes to 3.12 hours\t27,514\t2.46 hours to 20.39 hours\n2019-09-07\t78,941\t50.65 minutes to 1.66 hours\t28,812\t2.42 hours to 13.59 hours\n2019-12-13\t69,589\t50.77 minutes to 1.55 hours\t25,322\t2.45 hours to 1.13 days\n2020-03-25 (fr)\t139,278\t49.45 minutes to 1.53 hours\t32,302\t2.48 hours to 3.62 days\n2020-06-26\t278,504\t48.98 minutes to 2.29 hours\t20,343\t2.39 hours to 6.99 hours\n2020-10-21\t107,633\t50.80 minutes to 1.54 hours\t20,688\t15.33 minutes to 8.62 hours\n2021-03-20\t158,956\t50.80 minutes to 1.64 hours\t25,760\t2.34 hours to 11.62 hours\n2021-06-26\t547,907\t51.93 minutes to 6.73 hours\t29,728\t2.40 hours to 15.63 hours\n2021-10-10\t170,103\t51.88 minutes to 3.25 hours\t23,989\t2.39 hours to 13.05 hours\n2022-01-31\t354,386\t53.65 minutes to 8.09 hours\t24,391\t2.42 hours to 15.29 hours\n2022-05-09\t172,555\t51.83 minutes to 1.65 hours\t23,289\t2.41 hours to 16.90 hours\n2022-09-05\t153,453\t53.67 minutes to 4.15 hours\t23,594\t2.45 hours to 1.22 days\n2022-12-08\t181,075\t54.83 minutes to 6.67 hours\t27,111\t2.46 hours to 18.89 hours\n2026-02-01\t317,762\t50.30 minutes to 1.52 hours\t47,197\t10.91 hours to 21.30 hours\n2026-05-09\t246,776\t50.12 minutes to 1.52 hours\t35,264\t5.81 hours to 15.60 hours\n2026-08-10\t373,244\t52.05 minutes to 2.07 hours\t45,319\t8.73 hours to 16.52 hours\nKEY OBSERVATION:\nAcross 21 Wayback captures spanning 2018-02-03 to 2026-08-10, daily refund submissions ranged from 60,494 (May 2018) to 547,907 (June 2021) — a 9.1× spread. The 2026 figure is 373,244 (+278% vs the February 2018 capture).\nOver those same nine years the published lower bound for refund response time never left a 49–55 minute band: a total movement of under six minutes while the workload behind it moved by a factor of nine.\nIf a person read each ticket for even 5 seconds, processing 373,244 tickets per day (current) would occupy 22 agents working 24/7 just to open and close them; at peak (547,907, June 2021) that rises to 32.\nIf the published response time reflected per-ticket handling time (~52 min/ticket), the implied concurrent staffing would be on the order of 13,500 agents at current volume and ~20,000 at peak. No sourced figure for Valve's support headcount has been located; none is assumed here.\nWhat follows: the volume-to-headcount ratio is inconsistent with per-ticket human review at the published response times. The figures are consistent with a largely automated first pass; what proportion receives human review is not published.\nWhy this matters for GDPR compliance\n\nGDPR Article 22 prohibits solely automated individual decision-making that produces significant legal effects, without providing the right to human review on request. If Steam Support decisions (ticket closures, account actions, refusal of data requests) are made entirely by automated scripts, every such decision that \"significantly affects\" the user may violate Article 22.\n\nTicket HT-2YBP-F7JP-D4VB (Section 18) was closed after three days with a template referral and no engagement with the legal basis cited. Whether a person reviewed it cannot be determined from the ticket; that is a question the supervisory authority can put to Valve under Article 22 and Article 15(1)(h).\n\nSource: Wayback Machine snapshots of store.steampowered.com/stats/support (2018-02-03, 2021-06-26, 2026-08-10) — data extracted into VALVE_EVIDENCE_PACK/databases/steam_support_stats_history.json (21 snapshots, 2018–2026). Note: the \"~52 min\" response time is the refund-category lower bound; account security response was 2.4–16.5 hrs across the same snapshots. 2021-06-26 is the all-time peak (547,907 refund requests), not a monotone midpoint — volume surged ~6× in 2020–2021 then partially fell before recovering to 373K in 2026.\nAppendix I — Dataset scope · counts that can be reproduced\nCount the records. Check the scope.\nContext & source limits\n\nCount the records, then test the claims: every figure below is re-derivable from the published files.\n\nInspect the underlying datasets, reproduce the counts, and distinguish source rows from unique incidents.\n\nThe master CSV contains 40,448 rows. Of these, 36,516 come from the Discord-AntiScam phishing feed. The remaining 3,932 rows span GitHub, reviews, search results, forum material and other sources, providing a comprehensive index of reported community topics and security reports.\n\nWithin that CSV, 1,690 rows are categorised under the \"Unpatched Security Exploit\" collection label, representing historical user issues and vulnerability disclosures. Tracing these reports involves reviewing each thread's specific build timeline and public patch history.\n\nThe 16,319-record searchable archive is a separate, curated build with its own manifest, designed for precise local exploration of specific user claims and incident reports.\n\nTo build a reliable audit trail, every user-reported record must be verified against documented build timelines and historical patch logs.\n\nThe separate Part II collection records 231,829 unique listing IDs, including 33,509 in the automated registration category and 198,320 flagged as unverified transfers. The input file's SHA-256 matches the preserved measurement. These counts describe listing attempts and observed transfers rather than finalized transaction values or verified theft totals, highlighting the need for primary platform records to measure the exact economic impact. Listing measurements and hashes ↗\n\nMaster CSV ↗ · Searchable archive manifest ↗ · Inspect source records ↗\n\nAppendix J — About this investigation\nValve publishes no enforcement record. We built one.\n\nIndependent. Non-commercial. Built from public data only. Submitted to regulators.\n\n88.97%automation fleet untouched — no ban of any kind\n67.77%of 51,732 adjudicated scammers walk free\n$26.8M+floor on store spend by non-limited fleet\n3.6%gambling domains blocked by Valve's Link Filter\n8 yearsof security incidents documented\n\nWhat this is. A forensic dossier into Valve Corporation's Steam platform — its enforcement record, its card-farming economy, its legal framework, and the authentication infrastructure that gambling operators use through Steam's own OpenID relay. Every figure is reproducible from two sources: Valve's own public API and the datasets published alongside this investigation.\n\nWho it is for. Regulators with jurisdiction over Valve — the GDPR supervisory authority for the Netherlands, FinCEN, the SEC, the DSA Digital Services Coordinator, UOKiK, and any law enforcement agency examining Steam-linked financial flows. Also for journalists, researchers, and every user who received a permanent account ban, a refused refund, or a stolen inventory and was told there is no appeal.\n\nThe single demand. Valve holds this data at full fidelity — ban reasons attached, full ID space, real-time. It can run every query in this dossier in seconds and has chosen not to publish any of it. The question for any competent authority is simple: why not?\n\nWhat the authors do not claim. No login to Steam was completed on any third-party platform during this work. A supplied OpenID URL establishes the request parameters, not a completed login. A separate registrable domain is not by itself proof of evasion. Registration dates are lower bounds on when a host could first have appeared in an OpenID request; they do not establish continuous use. The authors do not assert what Valve knew or intended: every statement about Valve is tied to a dated public document or a dated observation. Where a claim could not be put behind a source document, it has been removed.\n\nWho we are\n\nPhishDestroy — independent investigators. No affiliation with Valve Corporation or any platform named here. One Steam account was used solely to document the GDPR request in Section 18.\n\nLegal disclaimer\n\nNon-commercial, decentralized public-interest investigation. All data provided \"as is\" with zero warranties. This publication is not a judicial finding.\n\nPUBLIC DOMAIN\nLicensing\n\nAll rights surrendered to humanity. Reproduce, adapt, publish — attribution not required. OFAC-region access: prohibited. Full licence & disclaimer →",
        "headings": [
          {
            "level": 2,
            "id": "briefing-heading",
            "text": "The rule. The record. The unanswered questions."
          },
          {
            "level": 2,
            "id": null,
            "text": "Open letter to the Washington State Gambling Commission"
          },
          {
            "level": 3,
            "id": "wsgc-public-address-title",
            "text": "Ten days became ten years.Reopen the record."
          },
          {
            "level": 2,
            "id": null,
            "text": "The site is blocked. The login route is not."
          },
          {
            "level": 3,
            "id": null,
            "text": "Figure 3.1 — The two routes, drawn."
          },
          {
            "level": 3,
            "id": null,
            "text": "The Big Picture Trap: Link Filter is Compliance Theater, Not a Shield"
          },
          {
            "level": 3,
            "id": null,
            "text": "A blocked main domain paired with an unblocked auth host leaves the login route open — and it stays open for years."
          },
          {
            "level": 3,
            "id": null,
            "text": "Background: What Steam Is and Why It Matters Here"
          },
          {
            "level": 3,
            "id": null,
            "text": "What Valve Did: The Domain Block"
          },
          {
            "level": 3,
            "id": null,
            "text": "What a Proxy Domain Is"
          },
          {
            "level": 3,
            "id": null,
            "text": "The Critical Point: The Auth Host Is Sent to Steam in Every Request"
          },
          {
            "level": 3,
            "id": null,
            "text": "What This Proves"
          },
          {
            "level": 3,
            "id": null,
            "text": "Inside Steam, Valve's list is the only list."
          },
          {
            "level": 3,
            "id": null,
            "text": "Link filter protection bypass"
          },
          {
            "level": 3,
            "id": null,
            "text": "Big Picture web browser leaks login cookies and discloses sensitive information (may lead to account takeover)"
          },
          {
            "level": 3,
            "id": null,
            "text": "What this means for a minor with an antivirus installed"
          },
          {
            "level": 3,
            "id": null,
            "text": "The domain’s age.The observation’s date."
          },
          {
            "level": 2,
            "id": null,
            "text": "An endpoint closed. Public tracing lost a key."
          },
          {
            "level": 3,
            "id": null,
            "text": "The Pre-Blackout Era"
          },
          {
            "level": 3,
            "id": null,
            "text": "After the change"
          },
          {
            "level": 2,
            "id": null,
            "text": "One session. More access than the user sees."
          },
          {
            "level": 3,
            "id": null,
            "text": "1. Insufficient Step-up Authentication"
          },
          {
            "level": 3,
            "id": null,
            "text": "2. Lack of Principle of Least Privilege"
          },
          {
            "level": 3,
            "id": null,
            "text": "3. Broken Session Management"
          },
          {
            "level": 3,
            "id": null,
            "text": "4. Domain-Level Blocking of Auth Hosts Was Technically Feasible"
          },
          {
            "level": 3,
            "id": "integration-paradox-title",
            "text": "Valve builds against these rules every day. It did not build to them here."
          },
          {
            "level": 4,
            "id": null,
            "text": "GitHub Fine-Grained Scopes vs Valve Steam Web API"
          },
          {
            "level": 2,
            "id": null,
            "text": "Interactive Exploit & Hijack Simulator"
          },
          {
            "level": 2,
            "id": null,
            "text": "The endpoints behind the sequence."
          },
          {
            "level": 2,
            "id": null,
            "text": "A checked box. Whose action?"
          },
          {
            "level": 3,
            "id": null,
            "text": "How Valve Finally Neutralized \"Trade Substitution\" — And Why It Took 7 Years of Workarounds"
          },
          {
            "level": 4,
            "id": null,
            "text": "Avatar & Name Cooldown (Feb 2024)"
          },
          {
            "level": 4,
            "id": null,
            "text": "7-Day CS2 Trade Reversal (Jul 2025)"
          },
          {
            "level": 4,
            "id": null,
            "text": "Mandatory Mobile Push for API (Dec 2023)"
          },
          {
            "level": 4,
            "id": null,
            "text": "Account Age & Name Banners (2022–2024)"
          },
          {
            "level": 2,
            "id": null,
            "text": "Their rulebook. The recorded platforms."
          },
          {
            "level": 3,
            "id": "enforcement-focus-title",
            "text": "One rulebook. Unequal enforcement."
          },
          {
            "level": 4,
            "id": null,
            "text": "Automation"
          },
          {
            "level": 4,
            "id": null,
            "text": "Commercial use"
          },
          {
            "level": 4,
            "id": null,
            "text": "VPN & location disguise"
          },
          {
            "level": 4,
            "id": null,
            "text": "Link obfuscation"
          },
          {
            "level": 4,
            "id": null,
            "text": "Who reviews the decision when support closes the case?"
          },
          {
            "level": 2,
            "id": null,
            "text": "An automation API. A rule against automation."
          },
          {
            "level": 3,
            "id": null,
            "text": "The \"Game Developer\" Fallacy"
          },
          {
            "level": 4,
            "id": null,
            "text": "The Automation Contradiction"
          },
          {
            "level": 4,
            "id": null,
            "text": "A server-side position in the trade flow"
          },
          {
            "level": 2,
            "id": null,
            "text": "Ten days demanded. Ten years to account for."
          },
          {
            "level": 3,
            "id": "letter-company",
            "text": "VALVE CORPORATION"
          },
          {
            "level": 3,
            "id": null,
            "text": "Ten days.Then what?"
          },
          {
            "level": 3,
            "id": null,
            "text": "Follow the declared return host."
          },
          {
            "level": 3,
            "id": "washington-record-heading",
            "text": "Two deadlines. One unanswered enforcement standard."
          },
          {
            "level": 4,
            "id": null,
            "text": "Valve gives gambling sites 10 days"
          },
          {
            "level": 4,
            "id": null,
            "text": "Washington presses Valve"
          },
          {
            "level": 4,
            "id": null,
            "text": "Valve rejects the charge"
          },
          {
            "level": 4,
            "id": null,
            "text": "The routes observed in September 2026"
          },
          {
            "level": 4,
            "id": null,
            "text": "Eighteen months after Valve replied, the regulator still called it an intent."
          },
          {
            "level": 3,
            "id": null,
            "text": "The 10-Day Notice Decade: Forensic Survival Audit of the 23 Named Sites"
          },
          {
            "level": 4,
            "id": null,
            "text": "From 10-Day Warnings to Offshore Conglomerates: The Multi-Billion-Dollar Turnover"
          },
          {
            "level": 2,
            "id": null,
            "text": "The hostname is already in the request."
          },
          {
            "level": 3,
            "id": null,
            "text": "Documented and reported precedents"
          },
          {
            "level": 3,
            "id": null,
            "text": "What a registration date does and does not show"
          },
          {
            "level": 3,
            "id": null,
            "text": "Comparative Audit: API Compliance Standards"
          },
          {
            "level": 2,
            "id": "market-thesis-heading",
            "text": "The off-Steam price gap"
          },
          {
            "level": 2,
            "id": null,
            "text": "The price gap is measurable."
          },
          {
            "level": 3,
            "id": null,
            "text": "What the dollar figure shows"
          },
          {
            "level": 3,
            "id": null,
            "text": "Many venues list more dollar value than Steam."
          },
          {
            "level": 3,
            "id": null,
            "text": "Steam still leads in number of offers."
          },
          {
            "level": 3,
            "id": null,
            "text": "The commercial ecosystem is in plain sight."
          },
          {
            "level": 2,
            "id": null,
            "text": "Who can reset the safeguards?"
          },
          {
            "level": 3,
            "id": null,
            "text": "A recovery ticket that disabled the account's security, and a reported $10,000 loss"
          },
          {
            "level": 3,
            "id": null,
            "text": "Beyond the inventory."
          },
          {
            "level": 3,
            "id": "theft-ledger-title",
            "text": "Valve admitted the door twice, thirty-three months apart. It never closed."
          },
          {
            "level": 4,
            "id": null,
            "text": "What the ledger says that no single case does."
          },
          {
            "level": 3,
            "id": null,
            "text": "Confidentiality must come with technical accountability."
          },
          {
            "level": 2,
            "id": null,
            "text": "Follow the money. Separate the transactions."
          },
          {
            "level": 3,
            "id": null,
            "text": "Where the money actually moves."
          },
          {
            "level": 3,
            "id": null,
            "text": "Classify the activity, then the obligation."
          },
          {
            "level": 3,
            "id": null,
            "text": "Trace proceeds, knowledge and assistance."
          },
          {
            "level": 2,
            "id": null,
            "text": "The Digital Services Act: put knowledge on the record"
          },
          {
            "level": 3,
            "id": null,
            "text": "A ten-day demand."
          },
          {
            "level": 3,
            "id": null,
            "text": "The DSA time window."
          },
          {
            "level": 3,
            "id": null,
            "text": "Duration needs a notice trail."
          },
          {
            "level": 3,
            "id": null,
            "text": "of annual worldwide turnover"
          },
          {
            "level": 2,
            "id": null,
            "text": "Minors: a Steam login is not an age check"
          },
          {
            "level": 3,
            "id": null,
            "text": "Identify the operator and the data."
          },
          {
            "level": 3,
            "id": null,
            "text": "Record the journey from login to deposit."
          },
          {
            "level": 2,
            "id": null,
            "text": "The request. The reply. The missing comparison."
          },
          {
            "level": 3,
            "id": null,
            "text": "The records exist; the data subject did not receive them."
          },
          {
            "level": 2,
            "id": null,
            "text": "The Subscriber Agreement against the platform's own architecture"
          },
          {
            "level": 3,
            "id": null,
            "text": "The Market ceiling and the commercial-use prohibition"
          },
          {
            "level": 3,
            "id": null,
            "text": "The API-key vulnerability as a platform design question rather than user negligence"
          },
          {
            "level": 3,
            "id": null,
            "text": "Valve receives the auth hostname on every login"
          },
          {
            "level": 3,
            "id": null,
            "text": "The pattern in the archived complaints"
          },
          {
            "level": 3,
            "id": null,
            "text": "A court evaluating this record would not read the SSA in isolation."
          },
          {
            "level": 2,
            "id": null,
            "text": "The findings. The records we ask for."
          },
          {
            "level": 2,
            "id": null,
            "text": "Evidence Memorandum — material provided by Source 1"
          },
          {
            "level": 2,
            "id": null,
            "text": "The redaction in the produced PDF is cosmetic: the covered text remains extractable"
          },
          {
            "level": 2,
            "id": null,
            "text": "Support and Legal Correspondence Exhibits"
          },
          {
            "level": 2,
            "id": null,
            "text": "Selected primary records"
          },
          {
            "level": 3,
            "id": "receipt-heading-gh-01",
            "text": "Hardware keys, requested in 2016"
          },
          {
            "level": 3,
            "id": "receipt-heading-gh-02",
            "text": "Crash reports without an effective opt-out"
          },
          {
            "level": 3,
            "id": "receipt-heading-gh-03",
            "text": "Auth-ticket abuse reported to Valve"
          },
          {
            "level": 3,
            "id": "receipt-heading-rd-01",
            "text": "44 disputed Market purchases"
          },
          {
            "level": 3,
            "id": "receipt-heading-rd-02",
            "text": "A permanent ban and closed appeals"
          },
          {
            "level": 3,
            "id": "receipt-heading-rd-03",
            "text": "A recovery reset and a reported $10,000 loss"
          },
          {
            "level": 2,
            "id": null,
            "text": "ArchiSteamFarm and the automation clause"
          },
          {
            "level": 2,
            "id": null,
            "text": "Rules ledger: clauses against recorded platforms"
          },
          {
            "level": 3,
            "id": "ledger-title",
            "text": "Commercial Use & Account Charging"
          },
          {
            "level": 3,
            "id": "lw-register-title",
            "text": "Platform register 175"
          },
          {
            "level": 4,
            "id": null,
            "text": "Burden of proof"
          },
          {
            "level": 4,
            "id": null,
            "text": "What a tagged record is, and is not"
          },
          {
            "level": 2,
            "id": null,
            "text": "DSAR playbook: request the evidence"
          },
          {
            "level": 3,
            "id": null,
            "text": "Preserve your timeline."
          },
          {
            "level": 3,
            "id": null,
            "text": "Request your retained data."
          },
          {
            "level": 3,
            "id": null,
            "text": "Keep the delivery record."
          },
          {
            "level": 3,
            "id": null,
            "text": "Compare the response."
          },
          {
            "level": 3,
            "id": null,
            "text": "Account security & access records"
          },
          {
            "level": 3,
            "id": null,
            "text": "A discrepancy is evidence to investigate."
          },
          {
            "level": 2,
            "id": null,
            "text": "Support volume. Published response times."
          },
          {
            "level": 3,
            "id": null,
            "text": "Two queues at one support desk, read across 21 archived captures."
          },
          {
            "level": 2,
            "id": null,
            "text": "Count the records. Check the scope."
          },
          {
            "level": 2,
            "id": null,
            "text": "Valve publishes no enforcement record.\nWe built one."
          }
        ],
        "links": [
          "https://phishdestroy.io/steam_dossier/de/",
          "https://dotesports.com/counter-strike/news/csgo-lounge-billion-bets-3896",
          "https://store.steampowered.com/agreement/?l=english",
          "http://web.archive.org/web/20260921022032/https://store.steampowered.com/agreement/?l=english",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-all-results.json",
          "https://blog.counter-strike.net/expresstrade/",
          "http://web.archive.org/web/20260307161538/https://blog.counter-strike.net/expresstrade/",
          "https://wsgc.wa.gov/news/2016/washington-state-gambling-commission-orders-valve-stop-skins-gambling",
          "http://web.archive.org/web/20260520012601/https://wsgc.wa.gov/news/2016/washington-state-gambling-commission-orders-valve-stop-skins-gambling",
          "https://fr.scribd.com/document/328063293/Valve-s-Oct-18th-response-to-Washington-State-Gambling-Commission-s-cease-and-desist",
          "https://store.steampowered.com/oldnews/22883",
          "http://web.archive.org/web/20260921021947/https://store.steampowered.com/oldnews/22883",
          "http://web.archive.org/web/20260921022628/https://steamcommunity.com/linkfilter/?url=https:%2F%2Frollbit.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/rbsnin.com.20260921T021120Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rollbit.com.json",
          "http://web.archive.org/web/20260921022740/https://steamcommunity.com/linkfilter/?url=https:%2F%2Fskin.club",
          "http://web.archive.org/web/20260921022842/https://steamcommunity.com/linkfilter/?url=https:%2F%2Fsc-auth.net",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skin.club.json",
          "http://web.archive.org/web/20260921022603/https://steamcommunity.com/linkfilter/?url=https:%2F%2Fhowl.gg",
          "http://web.archive.org/web/20260921022636/https://steamcommunity.com/linkfilter/?url=https:%2F%2Fhowl.uno",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/howl.gg.json",
          "http://web.archive.org/web/20260921022840/https://steamcommunity.com/linkfilter/?url=https:%2F%2Fduelbits.com",
          "http://web.archive.org/web/20260921022901/https://steamcommunity.com/linkfilter/?url=https:%2F%2Fswitchflips.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/duelbits.com.json",
          "http://web.archive.org/web/20260921022758/https://steamcommunity.com/linkfilter/?url=https:%2F%2Fcsgofast.com",
          "http://web.archive.org/web/20260921022847/https://steamcommunity.com/linkfilter/?url=https:%2F%2Fauthtofast.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgofast.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/farmskins.com.20260921T025840Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/steam.kobal.cc.20260921T025844Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/farmskins.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/cobaltlab.tech.20260921T041604Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/cobaltauth.com.20260921T041608Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/cobaltlab.tech.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/csgo.net.20260921T041619Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/cn2.easylot.net.20260921T041623Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgo.net.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/ggdrop.com.20260921T041637Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/ggauth.com.20260921T041641Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/ggdrop.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/rustchance.com.20260921T041703Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/hgfuihd.com.20260921T041706Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustchance.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/skin.fans.20260921T041710Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/auth.skinfans.com.20260921T041713Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skin.fans.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/skinport.com.20260921T041724Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/skinport.app.20260921T041728Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinport.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/skins.cash.20260921T041731Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/skinscash.live.20260921T041735Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skins.cash.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/tf2hunt.com.20260921T041739Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/rstspcl.com.20260921T041742Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tf2hunt.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/csgogem.com.20260922T192355Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/api.csgem.com.20260922T192358Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-2026-09-22.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/gamdom.com.20260922T192326Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/login.gambldom.com.20260922T192330Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/12cs.fail.20260922T192347Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/fail.games.20260922T192351Z.html",
          "http://web.archive.org/web/20260921022953/https://steamcommunity.com/linkfilter/?url=https:%2F%2Fcsgoempire.com",
          "http://web.archive.org/web/20260921022947/https://steamcommunity.com/linkfilter/?url=https:%2F%2Fcsgoempirelogin4.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgoempire.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/cs.money.20260921T021131Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/auth.dota.trade.20260921T021134Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/cs.money.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/csfloat.com.20260921T041612Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/csgofloat.com.20260921T041615Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csfloat.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/g4skins.com.20260921T041630Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/auth.g4s.to.20260921T041634Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/g4skins.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/juice.gg.20260921T041644Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/letmeinjuice.com.20260921T041648Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/juice.gg.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/market.csgo.com.20260921T041652Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/dota2.net.20260921T041655Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/market.csgo.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/rust.tm.20260921T041659Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rust.tm.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/csgolounge.com.20260922T192333Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/dota2.net.20260922T192340Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/dota2lounge.com.20260922T192337Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/skinbaron.de.20260921T041717Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/skinbaron.com.20260921T041721Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinbaron.de.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/tf2royal.com.20260921T041746Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/tf2auth.com.20260921T041750Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tf2royal.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/tradeit.gg.20260921T041753Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/connect-tradeit.com.20260921T041757Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tradeit.gg.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/upgrader.pro.20260921T041801Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-raw/upgauth.space.20260921T041804Z.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/upgrader.pro.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-recheck-2026-09-21.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registration.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/wayback-snapshots.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-2026-09-22c.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/master_registry.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/longitudinal-steam-phishing-audit.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-steam-phishing-100.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-coverage-2026-09-22.json",
          "https://blog.csfloat.com/how-floatdb-tracks-items/",
          "http://web.archive.org/web/20260921022415/https://blog.csfloat.com/how-floatdb-tracks-items/",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/platform-audit.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/platforms-removed.json",
          "https://hackerone.com/reports/291750",
          "http://web.archive.org/web/20251116185046/https://hackerone.com/reports/291750",
          "https://hackerone.com/reports/1079561",
          "http://web.archive.org/web/20260924181830/https://hackerone.com/reports/1079561",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/hackerone-reports.json",
          "https://phishdestroy.io/steam_dossier/de/steam_enforcement_evidence.html#support-records",
          "https://www.darknavy.org/blog/exploiting_steam_usual_and_unusual_ways_in_the_cef_framework/",
          "https://steamcommunity.com/groups/SteamClientBeta/discussions/0/3365901765276206401/",
          "http://web.archive.org/web/20250804051514/https://steamcommunity.com/groups/SteamClientBeta/discussions/0/3365901765276206401/",
          "https://www.chromium.org/developers/design-documents/safebrowsing/",
          "http://web.archive.org/web/20260821101616/https://www.chromium.org/developers/design-documents/safebrowsing/",
          "https://www.chromium.org/developers/how-tos/api-keys/",
          "http://web.archive.org/web/20260830122831/https://www.chromium.org/developers/how-tos/api-keys/",
          "https://github.com/Homebrew/homebrew-cask/issues/193814",
          "https://testsafebrowsing.appspot.com/",
          "https://phishdestroy.io/steam_dossier/AUTH_AUDIT.md",
          "https://datatracker.ietf.org/doc/rfc6749/",
          "https://docs.cloud.google.com/docs/authentication/api-keys",
          "https://listings.pcisecuritystandards.org/pdfs/PCI_DSS_Resource_Guide_(003).pdf",
          "https://developer.apple.com/news/?id=02202019a",
          "http://web.archive.org/web/20250506070026/https://developer.apple.com/news/?id=02202019a",
          "https://dev.twitch.tv/docs/authentication/validate-tokens/",
          "https://discuss.dev.twitch.com/t/legacy-twitch-api-v5-i-e-kraken-shutdown-reminder-february-28-2022/36589",
          "http://web.archive.org/web/20250127085635/https://discuss.dev.twitch.com/t/legacy-twitch-api-v5-i-e-kraken-shutdown-reminder-february-28-2022/36589",
          "https://store.steampowered.com/news/posts/?enddate=1788390000",
          "https://steamcommunity.com/groups/steamworks/announcements/detail/4123547285514022851",
          "https://skinvault.gg/blog/cs2-trade-protection-explained/",
          "https://csmarketcap.com/blog/market-insights/from-boom-to-bust-cs2s-trade-protection-impact",
          "https://skin.land/blog/steam-changes-cs2-trade-ban-logic-timing/",
          "https://help.steampowered.com/faqs/view/3041-A87A-E5F6-B6AC",
          "https://steamcommunity.com/ogg/593110/announcements/detail/533224478739530146",
          "https://steamcommunity.com/games/CSGO/announcements/detail/4447966961421256740",
          "https://steamcommunity.com/sharedfiles/filedetails/?id=2926756889",
          "https://steamcommunity.com/dev/apikey",
          "https://steamcommunity.com/groups/steamworks/announcements/detail/3734103130194459461",
          "https://steamcommunity.com/discussions/forum/1/3807266184852932971/",
          "https://help.steampowered.com/faqs/view/225C-C51E-B8F0-55B2",
          "https://store.steampowered.com/news/group/4/view/3314112260640237775",
          "https://github.com/DoctorMcKay/node-steam-tradeoffer-manager/issues/325",
          "https://blog.dota2.com/2020/05/trading-cooldown/",
          "https://blog.counter-strike.net/index.php/2018/03/20308/",
          "http://web.archive.org/web/20250226114333/https://blog.counter-strike.net/index.php/2018/03/20308/",
          "https://phishdestroy.io/steam_dossier/de/steam_evidence_archive.html",
          "https://steamcommunity.com/groups/steamworks/announcements/detail/493839547938902179",
          "https://store.steampowered.com/online_conduct",
          "http://web.archive.org/web/20260921022120/https://store.steampowered.com/online_conduct",
          "https://store.steampowered.com/subscriber_agreement/",
          "http://web.archive.org/web/20260918014700/https://store.steampowered.com/subscriber_agreement/",
          "https://steamcommunity.com/dev/apiterms",
          "http://web.archive.org/web/20260921022210/https://steamcommunity.com/dev/apiterms",
          "https://help.steampowered.com/en/faqs/view/628C-E332-BD8C-4D36",
          "https://phishdestroy.io/steam_dossier/de/social_graph.html",
          "https://phishdestroy.io/steam_dossier/de/security_timeline.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/wsgc-skins-gambling-briefing-2018.pdf",
          "https://wsgc.wa.gov/sites/default/files/2023-10/Skins%20Gambling.pdf",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/wsgc-briefing-manifest.json",
          "https://x.com/csgobig",
          "https://www.facebook.com/csgobigofficial/",
          "https://500.casino/",
          "https://csgolounge.com/",
          "https://csgocasino.gg/",
          "https://x.com/CSGOatsecom",
          "https://x.com/CSGOSweep/status/937420902538543106",
          "https://x.com/Wild",
          "https://x.com/csgopot",
          "https://x.com/csgodiamondscom",
          "https://www.ftc.gov/legal-library/browse/cases-proceedings/162-3184-csgo-lotto-matter",
          "https://x.com/CSGODouble",
          "https://x.com/csgo_massive",
          "https://www.facebook.com/csgostrongfree/",
          "https://www.facebook.com/CSNCOM/",
          "https://www.gamblingcommission.gov.uk/report/young-people-and-gambling",
          "https://www.aph.gov.au/Parliamentary_Business/Committees/Senate/Environment_and_Communications/Gamingmicro-transactions",
          "https://phishdestroy.io/steam_dossier/de/elite_skins.html",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/csfloat-catalogue.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/skinport-floor-over-cap.json",
          "https://pricempire.com/cs2-marketplaces",
          "http://web.archive.org/web/20260921022459/https://pricempire.com/cs2-marketplaces",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/priceempire-marketplaces.json",
          "https://www.steamanalyst.com/marketplace",
          "http://web.archive.org/web/20260719014552/https://www.steamanalyst.com/marketplace",
          "https://help.steampowered.com/en/faqs/view/61F0-72B7-9A18-C70B",
          "http://web.archive.org/web/20260921022227/https://help.steampowered.com/en/faqs/view/61F0-72B7-9A18-C70B",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/cs2sh-atlas.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/cs2sh-manifest.json",
          "https://phishdestroy.io/steam_dossier/de/skin_atlas.html",
          "https://phishdestroy.io/steam_dossier/de/steam_enforcement_evidence.html#case-support-recovery",
          "https://top10.owasp.org/2025/A01_2025-Broken_Access_Control/",
          "http://web.archive.org/web/20260920212535/https://top10.owasp.org/2025/A01_2025-Broken_Access_Control/",
          "https://store.steampowered.com/privacy_agreement/",
          "http://web.archive.org/web/20260921021648/https://store.steampowered.com/privacy_agreement/",
          "https://www.dexerto.com/csgo/csgo-skins-worth-millions-allegedly-stolen-with-help-from-steam-support-staff-2066939/",
          "http://web.archive.org/web/20250818113925/https://www.dexerto.com/csgo/csgo-skins-worth-millions-allegedly-stolen-with-help-from-steam-support-staff-2066939/",
          "https://www.dexerto.com/counter-strike-2/valve-saves-hacked-cs2-player-threatened-with-ransom-over-300000-of-rare-stickers-3283135/",
          "https://www.dexerto.com/csgo/over-2-million-in-csgo-skins-stolen-from-hacked-steam-account-1853092/",
          "http://web.archive.org/web/20220702042821/https://www.dexerto.com/csgo/over-2-million-in-csgo-skins-stolen-from-hacked-steam-account-1853092/",
          "https://www.kaspersky.com/blog/cs-go-two-million-usd-inventory-hack/44697/",
          "https://esportfire.com/article/the-2-million-usd-csgo-hack-22062022",
          "http://web.archive.org/web/20260515110250/https://esportfire.com/article/the-2-million-usd-csgo-hack-22062022",
          "https://esportsbetting.com/valve-deletes-130000-stolen-dragon-lore/",
          "https://esportfire.com/article/the-biggest-hack-in-csgo-history-csmoney-14082022",
          "http://web.archive.org/web/20251115173120/https://esportfire.com/article/the-biggest-hack-in-csgo-history-csmoney-14082022",
          "https://vkplay.ru/media/news/bloger-rasskazal-kak-podderzhka-steam-vorovala-akkaunty-igrokov/",
          "https://lis-skins.com/ru/blog/krupneisaia-mosenniceskaia-sxema-v-istorii-steam/",
          "https://escorenews.com/ru/csgo/news/44056-sotrudniki-podderjki-steam-zanimalis-krajey-skinov-s-akkauntov-za-god-oni-zarabotali-svyshe-300-tysyach-dollarov",
          "https://www.reddit.com/r/cs2/comments/1h53qp3/steam_support_is_stealing_accounts_again/",
          "http://web.archive.org/web/20250805141942/https://www.reddit.com/r/cs2/comments/1h53qp3/steam_support_is_stealing_accounts_again/",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/outsourcing-archive-records.json",
          "https://community.skin.club/en/news/collector-has-steam-inventory-returned-after-bold-hack",
          "https://esportfire.com/article/300k-scam-full-katowice-2014-holo-collection-hacked",
          "http://web.archive.org/web/20251217072445/https://esportfire.com/article/300k-scam-full-katowice-2014-holo-collection-hacked",
          "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng",
          "http://web.archive.org/web/20260920024236/https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng",
          "https://ag.ny.gov/press-release/2026/attorney-general-james-sues-game-developer-promoting-illegal-gambling-through",
          "http://web.archive.org/web/20260901015430/https://ag.ny.gov/press-release/2026/attorney-general-james-sues-game-developer-promoting-illegal-gambling-through",
          "https://www.fincen.gov/sites/default/files/2019-05/FinCEN%20CVC%20Guidance%20FINAL.pdf",
          "http://web.archive.org/web/20250711185007/https://www.fincen.gov/sites/default/files/2019-05/FinCEN%20CVC%20Guidance%20FINAL.pdf",
          "https://eur-lex.europa.eu/legal-content/EN/LSU/?uri=CELEX:32018L1673",
          "https://eur-lex.europa.eu/eli/dir/2024/1640/oj/eng",
          "http://web.archive.org/web/20260830153004/https://eur-lex.europa.eu/eli/dir/2024/1640/oj/eng",
          "https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng",
          "http://web.archive.org/web/20260920080125/https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng",
          "https://phishdestroy.io/steam_dossier/de/legal_analysis.html",
          "https://partner.steamgames.com/doc/features/auth#website",
          "http://web.archive.org/web/20260921022335/https://partner.steamgames.com/doc/features/auth",
          "https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa",
          "http://web.archive.org/web/20260921070051/https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/gdpr-ticket-1.png",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/screenshot-manifest.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/gdpr-ticket-2.png",
          "https://datenschutz.hamburg.de/beschwerde",
          "https://edpb.europa.eu/",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/regulatory-review/disclosure-audit.json",
          "https://phishdestroy.medium.com/my-dog-vs-elite-gdpr-lawyers-the-valve-data-breach-nobody-is-talking-about-f6f7683d813d",
          "http://web.archive.org/web/20260821155801/https://phishdestroy.medium.com/my-dog-vs-elite-gdpr-lawyers-the-valve-data-breach-nobody-is-talking-about-f6f7683d813d",
          "https://phishdestroy.io/steam_dossier/index#exhibit-gallery-section",
          "https://github.com/ValveSoftware/steam-for-linux/issues/4521",
          "https://phishdestroy.io/steam_dossier/de/steam_evidence_archive.html?source=GitHub&record=484",
          "https://github.com/ValveSoftware/steam-for-linux/issues/6459",
          "http://web.archive.org/web/20260419051343/https://github.com/ValveSoftware/steam-for-linux/issues/6459",
          "https://phishdestroy.io/steam_dossier/de/steam_evidence_archive.html?source=GitHub&record=467",
          "https://github.com/ValveSoftware/Source-1-Games/issues/3857",
          "https://phishdestroy.io/steam_dossier/de/steam_evidence_archive.html?source=GitHub&record=768",
          "https://www.reddit.com/r/DotA2/comments/vt76ov/funds_stolen_through_steam_market_disappointed/",
          "http://web.archive.org/web/20250320082450/https://www.reddit.com/r/DotA2/comments/vt76ov/funds_stolen_through_steam_market_disappointed/",
          "https://phishdestroy.io/steam_dossier/de/steam_evidence_archive.html?source=Reddit&record=4533",
          "https://www.reddit.com/r/ohnePixel/comments/1hahqx2/permanently_banned_steam_account_without_a_clear/",
          "https://phishdestroy.io/steam_dossier/de/steam_evidence_archive.html?source=Reddit&record=4766",
          "https://www.reddit.com/r/legaladvice/comments/1kipjde/got_10k_stollen_from_steam_inventory_due_to_steam/",
          "https://phishdestroy.io/steam_dossier/de/steam_evidence_archive.html?source=Reddit&record=4592",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/selected-evidence-records.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/archive_manifest.json",
          "https://phishdestroy.io/steam_dossier/de/card_economy.html",
          "https://github.com/JustArchiNET/ArchiSteamFarm/wiki/FAQ",
          "https://phishdestroy.io/steam_dossier/de/card_economy.html#scale",
          "https://phishdestroy.io/steam_dossier/de/card_economy.html#licence",
          "https://phishdestroy.io/steam_dossier/de/enforcement_audit.html",
          "https://github.com/JustArchiNET/ArchiSteamFarm",
          "http://web.archive.org/web/20260924181709/https://github.com/JustArchiNET/ArchiSteamFarm",
          "https://rdap.verisign.com/com/v1/domain/csgoempire.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgoempire.com",
          "https://rdap.verisign.com/com/v1/domain/csgoempirelogin4.com",
          "https://rdap.verisign.com/com/v1/domain/rustreaper.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frustreaper.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustreaper.com.json",
          "https://rdap.verisign.com/com/v1/domain/rustly.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frustly.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustly.com.json",
          "https://rdap.verisign.com/com/v1/domain/csgofast.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgofast.com",
          "https://rdap.verisign.com/com/v1/domain/authtofast.com",
          "https://rdap.verisign.com/com/v1/domain/duelbits.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fduelbits.com",
          "https://rdap.verisign.com/com/v1/domain/switchflips.com",
          "https://rdap.verisign.com/com/v1/domain/farmskins.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ffarmskins.com",
          "https://tld-rdap.verisign.com/cc/v1/domain/kobal.cc",
          "https://rdap.verisign.com/com/v1/domain/csgoluck.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgoluck.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgoluck.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/insane.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Finsane.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/insane.gg.json",
          "https://rdap.verisign.com/com/v1/domain/cs2skin.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcs2skin.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/cs2skin.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/juice.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fjuice.gg",
          "https://rdap.verisign.com/com/v1/domain/letmeinjuice.com",
          "https://rdap.verisign.com/com/v1/domain/ggdrop.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fggdrop.com",
          "https://rdap.verisign.com/com/v1/domain/ggauth.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/howl.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fhowl.gg",
          "https://rdap.radix.host/rdap/domain/howl.uno",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/chicken.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fchicken.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/chicken.gg.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/csgocasino.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgocasino.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgocasino.gg.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/hunt.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fhunt.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/hunt.gg.json",
          "https://rdap.verisign.com/com/v1/domain/csbattle.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsbattle.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csbattle.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/skinrave.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinrave.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinrave.gg.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/csdouble.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsdouble.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csdouble.gg.json",
          "https://rdap.verisign.com/com/v1/domain/rustchance.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frustchance.com",
          "https://rdap.verisign.com/com/v1/domain/hgfuihd.com",
          "https://rdap.radix.host/rdap/domain/cobaltlab.tech",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcobaltlab.tech",
          "https://rdap.verisign.com/com/v1/domain/cobaltauth.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/raided.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fraided.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/raided.gg.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/rustneo.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frustneo.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustneo.gg.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/splits.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fsplits.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/splits.gg.json",
          "https://rdap.identitydigital.services/rdap/domain/upgrader.pro",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fupgrader.pro",
          "https://rdap.radix.host/rdap/domain/upgauth.space",
          "https://rdap.centralnic.com/fans/domain/skin.fans",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskin.fans",
          "https://rdap.nic.one/domain/hotpizza.one",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fhotpizza.one",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/hotpizza.one.json",
          "https://rdap.verisign.com/com/v1/domain/g4skins.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fg4skins.com",
          "https://rdap.verisign.com/com/v1/domain/tf2royal.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ftf2royal.com",
          "https://rdap.verisign.com/com/v1/domain/tf2auth.com",
          "https://rdap.verisign.com/com/v1/domain/tf2hunt.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ftf2hunt.com",
          "https://rdap.verisign.com/com/v1/domain/rstspcl.com",
          "https://rdap.identitydigital.services/rdap/domain/tf2.bet",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ftf2.bet",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tf2.bet.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/openstars.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fopenstars.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/openstars.gg.json",
          "https://rdap.verisign.com/com/v1/domain/skins.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskins.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skins.com.json",
          "https://rdap.identitydigital.services/rdap/domain/white.market",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fwhite.market",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/white.market.json",
          "https://rdap.identitydigital.services/rdap/domain/moon.market",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fmoon.market",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/moon.market.json",
          "https://rdap.verisign.com/com/v1/domain/csfloat.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsfloat.com",
          "https://rdap.verisign.com/com/v1/domain/csgofloat.com",
          "https://rdap.identitydigital.services/rdap/domain/skin.land",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskin.land",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skin.land.json",
          "https://rdap.verisign.com/com/v1/domain/haloskins.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fhaloskins.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/haloskins.com.json",
          "https://rdap.verisign.com/com/v1/domain/163.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fbuff.163.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/buff.163.com.json",
          "https://rdap.verisign.com/com/v1/domain/csgo.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fmarket.csgo.com",
          "https://rdap.verisign.com/net/v1/domain/dota2.net",
          "https://rdap.verisign.com/com/v1/domain/skinport.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinport.com",
          "https://pubapi.registry.google/rdap/domain/skinport.app",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/skinflow.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinflow.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinflow.gg.json",
          "https://rdap.identitydigital.services/rdap/domain/skin.place",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskin.place",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skin.place.json",
          "https://rdap.verisign.com/com/v1/domain/skinsmonkey.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinsmonkey.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinsmonkey.com.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinbaron.de",
          "https://rdap.verisign.com/com/v1/domain/skinbaron.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frust.tm",
          "https://rdap.verisign.com/com/v1/domain/pirateswap.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fpirateswap.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/pirateswap.com.json",
          "https://rdap.radix.host/rdap/domain/mannco.store",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fmannco.store",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/mannco.store.json",
          "https://rdap.verisign.com/com/v1/domain/skinswap.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinswap.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinswap.com.json",
          "https://rdap.verisign.com/com/v1/domain/exeskins.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fexeskins.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/exeskins.com.json",
          "https://rdap.verisign.com/com/v1/domain/balticskins.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fbalticskins.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/balticskins.com.json",
          "https://rdap.nic.trade/domain/cs.trade",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcs.trade",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/cs.trade.json",
          "https://rdap.verisign.com/com/v1/domain/rapidskins.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frapidskins.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rapidskins.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/tradeit.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ftradeit.gg",
          "https://rdap.verisign.com/com/v1/domain/connect-tradeit.com",
          "https://rdap.verisign.com/com/v1/domain/49skins.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2F49skins.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/49skins.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/skinvault.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinvault.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinvault.gg.json",
          "https://rdap.identitydigital.services/rdap/domain/aim.market",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Faim.market",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/aim.market.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/skinout.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinout.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinout.gg.json",
          "https://rdap.verisign.com/com/v1/domain/ntskins.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fntskins.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/ntskins.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/gamerpay.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fgamerpay.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/gamerpay.gg.json",
          "https://rdap.nic.tf/domain/scrap.tf",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fscrap.tf",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/scrap.tf.json",
          "https://rdap.nic.tf/domain/marketplace.tf",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fmarketplace.tf",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/marketplace.tf.json",
          "https://rdap.identitydigital.services/rdap/domain/skins.cash",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskins.cash",
          "https://rdap.identitydigital.services/rdap/domain/skinscash.live",
          "https://rdap.verisign.com/net/v1/domain/csgo.net",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgo.net",
          "https://rdap.verisign.com/net/v1/domain/easylot.net",
          "https://rdap.verisign.com/net/v1/domain/cybershoke.net",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcybershoke.net",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/cybershoke.net.json",
          "https://rdap.verisign.com/net/v1/domain/fastcup.net",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ffastcup.net",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/fastcup.net.json",
          "https://rdap.verisign.com/com/v1/domain/leetify.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fleetify.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/leetify.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/scope.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fscope.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/scope.gg.json",
          "https://rdap.verisign.com/com/v1/domain/tradeupspy.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ftradeupspy.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tradeupspy.com.json",
          "https://rdap.identitydigital.services/rdap/domain/cs.deals",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcs.deals",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/cs.deals.json",
          "https://rdap.verisign.com/com/v1/domain/pricempire.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fpricempire.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/pricempire.com.json",
          "https://rdap.identitydigital.services/rdap/domain/lzt.market",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Flzt.market",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/lzt.market.json",
          "https://rdap.verisign.com/com/v1/domain/z2u.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fz2u.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/z2u.com.json",
          "https://rdap.verisign.com/com/v1/domain/csgoroll.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgoroll.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgoroll.com.json",
          "https://rdap.verisign.com/com/v1/domain/rollbit.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frollbit.com",
          "https://rdap.verisign.com/com/v1/domain/rbsnin.com",
          "https://rdap.identitydigital.services/rdap/domain/500.casino",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2F500.casino",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/500.casino.json",
          "https://rdap.verisign.com/com/v1/domain/csgobig.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgobig.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgobig.com.json",
          "https://rdap.verisign.com/com/v1/domain/casedrop.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcasedrop.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/casedrop.com.json",
          "https://rdap.verisign.com/com/v1/domain/banditcamp.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fbanditcamp.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/banditcamp.com.json",
          "https://rdap.verisign.com/com/v1/domain/skinbox.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinbox.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinbox.com.json",
          "https://rdap.verisign.com/com/v1/domain/tastydrop.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ftastydrop.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tastydrop.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/csgopolygon.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgopolygon.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgopolygon.gg.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/magicdrop.ru.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fmagicdrop.ru",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/magicdrop.ru.json",
          "https://rdap.verisign.com/com/v1/domain/csdice.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsdice.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csdice.com.json",
          "https://rdap.verisign.com/com/v1/domain/skinodds.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinodds.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinodds.com.json",
          "https://rdap.verisign.com/com/v1/domain/csgowin.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgowin.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgowin.com.json",
          "https://rdap.verisign.com/net/v1/domain/csgorun.net",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgorun.net",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgorun.net.json",
          "https://rdap.verisign.com/com/v1/domain/openskins.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fopenskins.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/openskins.com.json",
          "https://rdap.verisign.com/com/v1/domain/rustbet.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frustbet.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustbet.com.json",
          "https://rdap.verisign.com/com/v1/domain/csgomagic.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgomagic.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgomagic.com.json",
          "https://rdap.verisign.com/com/v1/domain/csgobounty.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgobounty.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgobounty.com.json",
          "https://rdap.verisign.com/com/v1/domain/ezskins.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fezskins.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/ezskins.com.json",
          "https://rdap.verisign.com/com/v1/domain/rustcases.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frustcases.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustcases.com.json",
          "https://rdap.verisign.com/com/v1/domain/csgoreaper.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgoreaper.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgoreaper.com.json",
          "https://rdap.verisign.com/com/v1/domain/csgocases.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgocases.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgocases.com.json",
          "https://rdap.verisign.com/com/v1/domain/csgo-skins.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgo-skins.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgo-skins.com.json",
          "https://rdap.verisign.com/com/v1/domain/csgonet.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgonet.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgonet.com.json",
          "https://rdap.verisign.com/com/v1/domain/wtfskins.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fwtfskins.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/wtfskins.com.json",
          "https://rdap.verisign.com/com/v1/domain/flamecases.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fflamecases.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/flamecases.com.json",
          "https://rdap.verisign.com/com/v1/domain/gamedom.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fgamedom.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/gamedom.com.json",
          "https://rdap.nic.club/domain/skin.club",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskin.club",
          "https://rdap.verisign.com/net/v1/domain/sc-auth.net",
          "https://rdap.verisign.com/com/v1/domain/daddyskins.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fdaddyskins.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/daddyskins.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/rustix.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frustix.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustix.gg.json",
          "https://rdap.nic.club/domain/skins.club",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskins.club",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skins.club.json",
          "https://rdap.publicinterestregistry.org/rdap/domain/csgohouse.org",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgohouse.org",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgohouse.org.json",
          "https://rdap.verisign.com/net/v1/domain/skinrave.net",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinrave.net",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinrave.net.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/bloodycase.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fbloodycase.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/bloodycase.gg.json",
          "https://rdap.verisign.com/com/v1/domain/csgoclicker.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgoclicker.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgoclicker.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/rustbet.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frustbet.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustbet.gg.json",
          "https://rdap.verisign.com/com/v1/domain/cs-drop.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcs-drop.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/cs-drop.com.json",
          "https://rdap.verisign.com/net/v1/domain/hellstore.net",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fhellstore.net",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/hellstore.net.json",
          "https://rdap.verisign.com/com/v1/domain/rustloot.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frustloot.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustloot.com.json",
          "https://rdap.verisign.com/com/v1/domain/csgo-case.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgo-case.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgo-case.com.json",
          "https://rdap.verisign.com/com/v1/domain/csgogem.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgogem.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgogem.com.json",
          "https://rdap.verisign.com/com/v1/domain/rainbet.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frainbet.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rainbet.com.json",
          "https://rdap.verisign.com/com/v1/domain/rustclash.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frustclash.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustclash.com.json",
          "https://rdap.identitydigital.services/rdap/domain/12cs.fail",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2F12cs.fail",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/12cs.fail.json",
          "https://rdap.verisign.com/com/v1/domain/tf2easy.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fwww.tf2easy.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tf2easy.com.json",
          "https://rdap.verisign.com/com/v1/domain/tf2blaze.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ftf2blaze.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tf2blaze.com.json",
          "https://rdap.verisign.com/com/v1/domain/shuffle.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fshuffle.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/shuffle.com.json",
          "https://rdap.identitydigital.services/rdap/domain/buff.market",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fbuff.market",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/buff.market.json",
          "https://rdap.identitydigital.services/rdap/domain/avan.market",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Favan.market",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/avan.market.json",
          "https://rdap.identitydigital.services/rdap/domain/cs.money",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcs.money",
          "https://rdap.verisign.com/com/v1/domain/uuskins.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fuuskins.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/uuskins.com.json",
          "https://rdap.verisign.com/com/v1/domain/youpin898.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fyoupin898.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/youpin898.com.json",
          "https://rdap.verisign.com/com/v1/domain/c5game.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fc5game.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/c5game.com.json",
          "https://rdap.verisign.com/com/v1/domain/waxpeer.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fwaxpeer.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/waxpeer.com.json",
          "https://rdap.verisign.com/com/v1/domain/dmarket.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fdmarket.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/dmarket.com.json",
          "https://rdap.verisign.com/com/v1/domain/steamcommunity.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fsteamcommunity.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/steamcommunity.com.json",
          "https://rdap.verisign.com/com/v1/domain/lootfarm.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Flootfarm.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/lootfarm.com.json",
          "https://rdap.verisign.com/com/v1/domain/rustskins.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Frustskins.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustskins.com.json",
          "https://rdap.verisign.com/com/v1/domain/krakatoa.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fkrakatoa.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/krakatoa.com.json",
          "https://rdap.verisign.com/com/v1/domain/shadowpay.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fshadowpay.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/shadowpay.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/igxe.cn.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Figxe.cn",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/igxe.cn.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/swap.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fswap.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/swap.gg.json",
          "https://rdap.verisign.com/com/v1/domain/bitskins.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fbitskins.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/bitskins.com.json",
          "https://rdap.verisign.com/com/v1/domain/tf2mart.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ftf2mart.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tf2mart.com.json",
          "https://rdap.verisign.com/com/v1/domain/skinbid.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinbid.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinbid.com.json",
          "https://rdap.verisign.com/com/v1/domain/lootbear.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Flootbear.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/lootbear.com.json",
          "https://rdap.nic.tf/domain/backpack.tf",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fbackpack.tf",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/backpack.tf.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fstntrading.eu",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/stntrading.eu.json",
          "https://rdap.verisign.com/com/v1/domain/skinwallet.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fskinwallet.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinwallet.com.json",
          "https://rdap.verisign.com/com/v1/domain/dota2market.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fdota2market.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/dota2market.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/xplay.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fxplay.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/xplay.gg.json",
          "https://rdap.verisign.com/com/v1/domain/esportal.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fesportal.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/esportal.com.json",
          "https://rdap.registro.br/domain/gamersclub.com.br",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fgamersclub.com.br",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/gamersclub.com.br.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/epidemic.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fepidemic.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/epidemic.gg.json",
          "https://rdap.verisign.com/com/v1/domain/cs2stash.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcs2stash.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/cs2stash.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/csgoskins.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgoskins.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgoskins.gg.json",
          "https://rdap.verisign.com/com/v1/domain/steamanalyst.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fsteamanalyst.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/steamanalyst.com.json",
          "https://rdap.verisign.com/net/v1/domain/steamcardexchange.net",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fsteamcardexchange.net",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/steamcardexchange.net.json",
          "https://rdap.verisign.com/com/v1/domain/dotabuff.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fdotabuff.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/dotabuff.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/tracker.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ftracker.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tracker.gg.json",
          "https://rdap.verisign.com/com/v1/domain/funpay.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Ffunpay.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/funpay.com.json",
          "https://rdap.verisign.com/com/v1/domain/playerauctions.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fplayerauctions.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/playerauctions.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/eldorado.gg.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Feldorado.gg",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/eldorado.gg.json",
          "https://rdap.verisign.com/com/v1/domain/g2a.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fg2a.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/g2a.com.json",
          "https://rdap.verisign.com/net/v1/domain/kinguin.net",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fkinguin.net",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/kinguin.net.json",
          "https://rdap.verisign.com/com/v1/domain/g2g.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fg2g.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/g2g.com.json",
          "https://rdap.verisign.com/com/v1/domain/playerup.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fplayerup.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/playerup.com.json",
          "https://rdap.verisign.com/net/v1/domain/smurfhub.net",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fsmurfhub.net",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/smurfhub.net.json",
          "https://rdap.verisign.com/com/v1/domain/smurfaccounts.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fsmurfaccounts.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/smurfaccounts.com.json",
          "https://rdap.verisign.com/com/v1/domain/buycsgorank.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fbuycsgorank.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/buycsgorank.com.json",
          "https://rdap.verisign.com/com/v1/domain/csgosmurfkings.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fcsgosmurfkings.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgosmurfkings.com.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registry/smurfstore.co.json",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fsmurfstore.co",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/smurfstore.co.json",
          "https://rdap.verisign.com/com/v1/domain/steamlvlup.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fsteamlvlup.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/steamlvlup.com.json",
          "https://rdap.verisign.com/com/v1/domain/steamlevels.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fsteamlevels.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/steamlevels.com.json",
          "https://rdap.verisign.com/com/v1/domain/levelsteam.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Flevelsteam.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/levelsteam.com.json",
          "https://rdap.verisign.com/com/v1/domain/steamlevelu.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fsteamlevelu.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/steamlevelu.com.json",
          "https://rdap.verisign.com/com/v1/domain/eloking.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Feloking.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/eloking.com.json",
          "https://rdap.publicinterestregistry.org/rdap/domain/boosteria.org",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fboosteria.org",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/boosteria.org.json",
          "https://rdap.verisign.com/com/v1/domain/overgear.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fovergear.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/overgear.com.json",
          "https://rdap.verisign.com/com/v1/domain/blazingboost.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fblazingboost.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/blazingboost.com.json",
          "https://rdap.verisign.com/com/v1/domain/dota2boost.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fdota2boost.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/dota2boost.com.json",
          "https://rdap.verisign.com/com/v1/domain/buyboost.com",
          "https://steamcommunity.com/linkfilter/?url=https%3A%2F%2Fbuyboost.com",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/buyboost.com.json",
          "https://help.steampowered.com/en/faqs/view/365F-4BEE-2AE2-7BDD",
          "https://store.steampowered.com/privacy_agreement/#8",
          "https://www.edpb.europa.eu/system/files/2023-04/edpb_guidelines_202201_data_subject_rights_access_v2_en.pdf",
          "https://web.archive.org/web/20260810154631/https://store.steampowered.com/stats/support",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/part2-measurements.json",
          "https://phishdestroy.io/steam_dossier/VALVE_EVIDENCE_PACK/databases/TOTAL_VALVE_SCANDALS_MASTER_DB.csv",
          "https://phishdestroy.io/steam_dossier/de/license_disclaimer.html"
        ]
      },
      "source_json": "index.content.json",
      "source_json_sha256": "8ff0a062e1fc652f2079ac4dba1757f5932b5a7288513895edacdaf752a2eb0e"
    },
    {
      "source": "https://phishdestroy.io/steam_dossier/investigation_part2",
      "language": "en",
      "title": "Account access & accountability — The Steam Dossier",
      "start_page": 100,
      "end_page": 107,
      "editorial_scope": {
        "policy": "Research prose, conclusions, methodological limits and analytical tables retained without paragraph truncation. Named catalogues and visual galleries are linked; raster images are not embedded.",
        "linked_sections": [],
        "raster_images_replaced": 0
      },
      "content": {
        "text": "Dieses Material ist auf Englisch verfügbar.Zurück zum Dossier · Deutsch ↗\n\nTHE STEAM DOSSIER / II\n\nPart II — Account Access, Outsourced Support & Enforcement\n\nPublic automation. Outsourced support. The people left counting the cost.\n\nBegin this subsection ↓\nEXHIBIT 01 / LIVE SHADOW MARKET SURVEILLANCE550,000+\n\nSteam accounts actively on sale on FSB Market (an anonymized label; the original name is withheld here)\nat this very moment\n\n550,000+ LIVE INVENTORY · 231,829 IN HISTORICAL SCRAPED CORPUS (198,320 STEALER LOGS)\n\nThe primary underground clearinghouse for hijacked Steam accounts, FSB Market (associated names withheld), authenticates both buyers and sellers using Valve's official Steam OpenID (openid.realm = https://FSB Market). At any given minute, over half a million stolen and compromised accounts (stealer logs from RedLine/Lumma, phishing captures, credential stuffing) are actively listed for pennies ($0.50–$2.00). Neither FSB Market nor the associated forum is blocked by Valve's Link Filter. This is the industrial reservoir supplying the 63.06% paid bot accounts that Valve bans without assisting the victim.\n\nLive Intel: Shadow Market Monitoring (550k+ Live) ↗ · Open capture record ↗ · Open Link Filter trace ↗550K+ LIVE\n\n01 / AN ECOSYSTEM WITH AUTHORS\n\nAutomation hasa paper trail.\n\nNamed projects. Published capabilities. Trace a tool to its documentation, then inspect the collected developer relationships.\n\n252REPOSITORIES COLLECTED\n3,320GITHUB PROFILES\n4,214PROFILE–REPOSITORY PAIRS\nValve infrastructureCommunity librariesReusable applications\nLines show documented integrations or dependencies. Select a node to follow its evidence.\n\nMulti-account automation / JustArchiNET\n\nArchiSteamFarm\n\nThe project explicitly advertises simultaneous card farming across Steam accounts. Its project file declares a SteamKit2 dependency.\n\nRead the project’s own documentation ↗\n\nSteamKit → ArchiSteamFarm\ndeclared dependency ↗\n\nCOLLECTED RELATIONSHIPS\n\n40 contributor labels · 40 forker labels\n\nContributor sample below. These labels describe the repository relationship, not employment or approval.\n\n@JustArchi@renovate[bot]@JustArchi-ArchiBot@dependabot-preview[bot]@renovate-bot@actions-user@dependabot-support@Abrynos\nWhat the developer graph establishes\n\nThe graph maps published contributor and forker relationships between named projects and GitHub profiles. These are public records — repository forks, contribution lists, profile associations. The question is what the paper trail of published capabilities and developer relationships requires Valve to answer, not what this investigation invented. Source hashes are saved in the map provenance.\n\nExplore the full network ↗Repository source data ↓\n\n02 / DIFFERENT CREDENTIALS. DIFFERENT POWERS.\n\nWhich keyare we talking about?\n\nPlaying a game does not require the player to issue a personal Web API key. That is the distinction at the centre of this inquiry.\n\n01 / USER ACCOUNT\nPersonal Web API key\nsteamcommunity.com/dev/apikey\n\nIssued from a user account for permitted API calls. Key creation, visibility, revocation and abuse detection are account-security questions.\n\n02 / GAME BACKEND\nPublisher Web API key\n\nSteamworks partners use publisher credentials for supported backend operations, including game-related services. A player’s personal key is a different credential.\n\n03 / IDENTITY & SESSION\nOpenID / session tokens\n\nOpenID confirms identity to a website. A Steam session or refresh token has a different purpose. These mechanisms should not be presented as one interchangeable “API key”.\n\nValve documents both user and publisher Web API keys. The entire Web API is therefore not separate from Steamworks. API key documentation ↗ archived 2026-09-15 ↗ · Game-session authentication ↗ archived 2026-08-29 ↗\n\nDOCUMENTED BY THE TOOL’S AUTHOR / MARCH 2024\n\nAutomation can use more than an API key.\n\nTrade Offer Manager’s wiki describes using a session access token for parts of the Web API when no separate API key exists. It also records mobile confirmation for key creation from late 2023. The maintainer calls token use this way unsupported by Valve; this is a dated documentation claim, not a live bypass test.\n\nInspect the maintainer’s explanation ↗ archived 2026-09-24 ↗\n\nTHE HUMAN SIDE / AN ILLUSTRATIVE PHISHING PATH\n\nStill playing.Already exposed.\n\nA message from a friend. A request to vote. A “thank you” page. To the player, the task is finished. A compromised session can outlast that moment.\n\nON THE PLAYER’S SCREEN\n\nF\nA FRIEND’S ACCOUNT\n\n“Can you vote for our team?”\n\nThe request arrives through Steam chat from a familiar account. In this scenario, the linked page opens in the client’s browser.\n\nOUT OF SIGHT\n\nThe trust starts before the website.\n\nA hijacked friend’s account can lend credibility to a phishing link. The surrounding Steam interface does not certify the destination website.\n\nFAMILIAR SENDER / EXTERNAL DESTINATION\nAccount security is the issue before any item is sold.\n\nThe player did not set out to create an automation credential or delegate control. Returning to a game is not evidence that the account is safe. Valve holds the session logs, the API key creation record, and the device correlation data. The victim does not. That asymmetry is the accountability problem.\n\nSession access and credential types\n\nAn API key and a logged-in session are separate credentials with different capabilities. Revoking a key does not terminate an active session. Valve’s own documentation describes both; Valve holds the logs that would show which credential was active at the time of any disputed action. The demand is disclosure of that record — not an inference the investigation has invented. Maintainer documentation on token handling ↗ archived 2026-09-24 ↗ · Valve key documentation ↗ archived 2026-09-15 ↗\n\n03 / THE OFFICIAL MARKET HAS A CEILING\n\nThe item can be rare.The limit stays.\n\nA price above the listing cap cannot be realised through one Community Market listing at that full price.\n\nILLUSTRATIVE ASKING PRICE$5,000Change the item’s asking price\n$100$20,000\n\nAn illustration of the published limit, not a valuation or recommendation to trade.\n\nLISTING CAP≈ $1,800\nWALLET CAP≈ $2,000\n\nAbove the published listing cap.\n\nWallet funds cannot be withdrawn to a bank account. These constraints create the demand that third-party skin markets fill: a demand the listing and wallet caps produce, while Valve's own rules prohibit commercial operators from meeting it.\n\nSteam’s market limits ↗ archived 2026-09-21 ↗\n\n04 / INSIDE THE SUPPORT BOUNDARY\n\nEntrusted with data.Accountable for access.\n\nValve’s privacy policy expressly provides for sharing personal data with third-party support providers, as necessary for support.\n\nTHE PLAYERAccount & evidence\n→\nVALVERecovery process\n→\nSUPPORT PROVIDERDelegated access\n\nPrivacy Policy §5.2 ↗ · Valve's own policy authorises third-party support access. The open questions are: what permissions were granted, what audit trails exist, and what happened when access was allegedly abused.\n\n2015\nThe scale was public\n\nValve acknowledged widespread account theft and described protective measures.\n\nValve publication ↗archived 2026-08-09 ↗\n2015\nValve outsourced the desk — and said so\n\nValve keeps a small in-house Steam Support Leadership team and stated it \"hired a couple different companies\" to handle support (Erik Johnson, Valve, to Kotaku); its privacy policy § 5.2 authorises those third parties' access to user data. Which contractor holds account-recovery access, Valve has never disclosed — community discussion names vendors such as Concentrix, but none is Valve-confirmed. The outsourced desk was in place years before either admission below.\n\nKotaku: Valve on its support ↗archived 2025-07-11 ↗\n2023\nThe first admission\n\nValve's CS:GO team accepts responsibility in writing for an account compromised through its own help-request process, and reverses the trades.\n\nOpen the outsourcing case ↓\n2025\nThe second admission\n\n33 months later, Steam Support writes that a technician \"failed to follow our process which resulted in your account restored to someone else.\" Same channel. Same outcome.\n\nDexerto, 14 Nov 2025 ↗\n\nCASE FILE / HFB & THE OUTSOURCING ALLEGATIONS\n\nThe way in was Steam Support itself.Valve said so in writing.\n\nIn the support reply reproduced by Dexerto, Valve's CS:GO team accepts responsibility for an account compromised through the help-request process — its own channel, not a phishing page and not the user. The items were recovered and the trades reversed, which is the remedy Valve tells other victims does not exist. HFB's inventory was reported at $2,000,000+ on the day and $3,000,000+ in the follow-up; Qkss lost $1,000,000+ the same way and got nothing.\n\nSUPPORT REPLY / REPRODUCED BY DEXERTO · 21 FEB 2023\n“compromised through a support help request, for which the CS:GO team takes responsibility”\nRead the reporting and reproduced message ↗ archived 2025-08-18 ↗\n01 / WHAT VALVE ADMITTED\nIts own support channel was the way in\n\nThe reply covers the compromised account and the reversal of its trades. Valve reversed them — so the trades were reversible. The original authenticated ticket is not in this collection.\n\n02 / WHAT THE SACKINGS DID NOT FIX\nThe same door opened again in November 2025\n\nThe contractor dismissed its entire Steam-support staff — reported by Mzkshow via Dexerto, not a Valve personnel statement. Thirty-three months later Steam Support wrote to another collector that \"a support technician that handled the help request failed to follow our process which resulted in your account restored to someone else.\" Valve's own sentence, about the same channel.\n\nThe second admission, 14 Nov 2025 ↗\n03 / WHAT IS OPEN\nValve has never named the contractor\n\nNeither the contractor nor the location is established by these sources. That is not a hole in the reporting — it is a disclosure Valve has not made about who held access to user accounts.\n\nContemporary account of the case ↗\n\nThree questions Valve has not answered: who could override account recovery, what the access audit found, and what changed afterwards.\n\nLater allegations in the preserved support archive\n\nTwo 2024 Reddit posts relay further Mzkshow investigations — a July 2024 VAC-ban removal case and a December 2024 $13,000 inventory case. These are separately reported incidents. The accountability question in each is identical: who had override access, what did the audit find, and what changed.\n\n14 July 2024 · reported recovery / VAC-ban case ↗2 December 2024 · reported $13,000 inventory case ↗archived 2025-08-05 ↗Two preserved posts, source rows & hashes ↓\n\n05 / FOLLOW THE LOSS\n\nEvery amountneeds a case.\n\nTen cases, June 2022 to March 2026. Every amount is the figure its named source published — $6,300,000, $2,000,000+, $1,000,000+, ≈$320,000, ≈$300,000, and down to €288. Valve holds the transaction log, the session record and the support audit trail for each one, and has produced none of them.\n\nSUPPORT CHANNEL21 JUN 2022\n$2,000,000+\nHFB — the largest inventory in the game\n\nREPORTED INVENTORY VALUATION · RAISED TO $3M+ IN THE FEB 2023 FOLLOW-UP\n\nSeven Souvenir Dragon Lores and the #1 Blue Gem Karambit, that knife alone at about $1.26m. Dormant three years with the authenticator still on; email and password changed through the support recovery route. Valve reversed the trades — and put its responsibility in writing. Before the reversal a reported $200,000+ of proceeds had already been withdrawn through market.csgo.com, which settles in cash and crypto. A reversal returns a skin, not the money someone already banked. The rollback also broke: a buyer hid his Souvenir Dragon Lore in an in-game Storage Unit, the script could not see inside its own container, and Valve duplicated a $130,000 item while undoing a theft — caught by item IDs and community reporting, deleted in July 2022, buyer refunded by BUFF rather than Valve.\n\nDexerto, day of the theft ↗\nWALLET & PURCHASES07 JUL 2022\n>$500\n44 disputed Market purchases\n\nCLAIMED WALLET SPENDING · USD\n\nA user reports unauthorized purchases of low-value Dota 2 items and an unsatisfactory support response.\n\nRead the complaint & linked screenshots ↗\nPLATFORM BREACH14 AUG 2022\n$6,300,000\nCS.Money — 19,000+ skins out of the bots\n\nPRICED VALUATION · FIRST ESTIMATE $1.6M\n\nAttackers took the mobile-authenticator files of the marketplace’s trading bots and emptied them, seeding part of the haul to well-known traders to blur the trail. Community researchers mapped 55 attacker accounts within hours. Valve reversed nothing — a third-party site sits outside Steam, said the same Steam whose inventory, trade API and account system carried the theft end to end.\n\nRead the contemporary account ↗\nSUPPORT CHANNELREPORTED 21 FEB 2023\n$1,000,000+\nQkss — same door, same actor, opposite answer\n\nREPORTED INVENTORY VALUATION\n\nTaken the way HFB was taken, by the same actor, through the same support help request. HFB was made whole eight months earlier. Qkss was not. Nothing in the published record separates the two cases except the size of the audience.\n\nDexerto on the Mzkshow investigation ↗\nSUPPORT CHANNELREPORTED FEB 2023\n≈ $320,000\nThe insider trade itself — one year of it\n\nPROCEEDS OVER ROUGHLY ONE YEAR · NOT AN INVENTORY VALUATION\n\nSupport-side access reached account history up to 15 years old: the first CD key, the first email, the first card — exactly the evidence the recovery process asks for. Whoever holds the database always wins that argument against whoever holds the account. One stolen M4A4 Howl with iBUYPOWER and Titan Katowice 2014 holos sold for $35,000 and ended up with NAVI’s b1t, who had no way of knowing. The contractor’s answer was to dismiss every employee working Steam support.\n\nEscorenews on the same investigation ↗\nWALLET & PURCHASES09 DEC 2023\n€288\nWallet loss despite two-step protection\n\nTRUSTPILOT · SOURCE INDEX 16\n\nThe reviewer reports a hacked account and a refusal to help with Market spending. The export has no individual review URL.\n\nInspect the source provenance ↗\nACCOUNT RECOVERY02 DEC 2024\n$13,000\n“Matvey” — two years after the sackings\n\nAUTHOR’S INVENTORY ESTIMATE\n\nRecovery granted to someone who supplied account data the owner himself could not match. Same route, same result, after the contractor had cleared out its Steam support desk.\n\nRead the preserved allegation ↗\nACCOUNT RECOVERY09 MAY 2025\n≈ $10,000\nRecovery through someone else’s ticket\n\nCLAIMED ITEM LOSS · USD\n\nA Quebec user alleges support reset the password and removed account protection following another person’s request.\n\nRead the first-person complaint ↗\nSUPPORT CHANNEL13 NOV 2025\n≈ $300,000\nHawkeye337 — and Valve’s second written admission\n\nFULL KATOWICE 2014 HOLO COLLECTION\n\nThe attacker demanded 1 bitcoin and began scraping the collection onto Negevs to destroy it. Steam Support’s reply: “a support technician that handled the help request failed to follow our process which resulted in your account restored to someone else.” Thirty-three months after the first admission, the same door. Restored within hours of the thread trending on X. Qkss did not have that audience.\n\nDexerto, 14 Nov 2025 ↗\nWALLET & PURCHASES29 MAR 2026\n$50\nUnauthorized top-up and gifted games\n\nTRUSTPILOT · SOURCE INDEX 290\n\nThe reviewer alleges unauthorized spending and unsuccessful refund requests. The individual review URL is missing from the export.\n\nInspect the source provenance ↗\n\nAttribution and amounts remain as reported by each source. Valve holds the transaction logs, session records and support audit trail for every one of these cases. Produce them. A preserved Reddit post does not settle the question — Valve's own records do.\n\nTHE COLLECTION / AFTER CHECKING\n\n231,829 accounts on sale.Valve holds the logs for every one.\n354 → 201\nTrustpilot records\n\n153 duplicate rows removed. Individual review URLs were not preserved in the export.\n\n231,829\nSteam account listings\n\n33,509 classified as autoregistered; 198,320 under the collector’s stealer label. Listings are not completed sales.\n\nCollection audit ↓Search the source archive ↗",
        "headings": [
          {
            "level": 1,
            "id": null,
            "text": "Part II — Account Access, Outsourced Support & Enforcement"
          },
          {
            "level": 2,
            "id": null,
            "text": "Automation hasa paper trail."
          },
          {
            "level": 3,
            "id": null,
            "text": "ArchiSteamFarm"
          },
          {
            "level": 2,
            "id": null,
            "text": "Which keyare we talking about?"
          },
          {
            "level": 3,
            "id": null,
            "text": "Personal Web API key"
          },
          {
            "level": 3,
            "id": null,
            "text": "Publisher Web API key"
          },
          {
            "level": 3,
            "id": null,
            "text": "OpenID / session tokens"
          },
          {
            "level": 3,
            "id": null,
            "text": "Automation can use more than an API key."
          },
          {
            "level": 2,
            "id": null,
            "text": "Still playing.Already exposed."
          },
          {
            "level": 3,
            "id": "session-hidden-title",
            "text": "The trust starts before the website."
          },
          {
            "level": 2,
            "id": null,
            "text": "The item can be rare.The limit stays."
          },
          {
            "level": 2,
            "id": null,
            "text": "Entrusted with data.Accountable for access."
          },
          {
            "level": 3,
            "id": null,
            "text": "The scale was public"
          },
          {
            "level": 3,
            "id": null,
            "text": "Valve outsourced the desk — and said so"
          },
          {
            "level": 3,
            "id": null,
            "text": "The first admission"
          },
          {
            "level": 3,
            "id": null,
            "text": "The second admission"
          },
          {
            "level": 3,
            "id": null,
            "text": "The way in was Steam Support itself.Valve said so in writing."
          },
          {
            "level": 4,
            "id": null,
            "text": "Its own support channel was the way in"
          },
          {
            "level": 4,
            "id": null,
            "text": "The same door opened again in November 2025"
          },
          {
            "level": 4,
            "id": null,
            "text": "Valve has never named the contractor"
          },
          {
            "level": 2,
            "id": null,
            "text": "Every amountneeds a case."
          },
          {
            "level": 3,
            "id": null,
            "text": "HFB — the largest inventory in the game"
          },
          {
            "level": 3,
            "id": null,
            "text": "44 disputed Market purchases"
          },
          {
            "level": 3,
            "id": null,
            "text": "CS.Money — 19,000+ skins out of the bots"
          },
          {
            "level": 3,
            "id": null,
            "text": "Qkss — same door, same actor, opposite answer"
          },
          {
            "level": 3,
            "id": null,
            "text": "The insider trade itself — one year of it"
          },
          {
            "level": 3,
            "id": null,
            "text": "Wallet loss despite two-step protection"
          },
          {
            "level": 3,
            "id": null,
            "text": "“Matvey” — two years after the sackings"
          },
          {
            "level": 3,
            "id": null,
            "text": "Recovery through someone else’s ticket"
          },
          {
            "level": 3,
            "id": null,
            "text": "Hawkeye337 — and Valve’s second written admission"
          },
          {
            "level": 3,
            "id": null,
            "text": "Unauthorized top-up and gifted games"
          },
          {
            "level": 2,
            "id": null,
            "text": "231,829 accounts on sale.Valve holds the logs for every one."
          },
          {
            "level": 3,
            "id": null,
            "text": "Trustpilot records"
          },
          {
            "level": 3,
            "id": null,
            "text": "Steam account listings"
          }
        ],
        "links": [
          "https://phishdestroy.io/steam_dossier/de/investigation_part2.html",
          "https://phishdestroy.io/live-intel/?category=steam",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/lzt.market.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-evidence-lzt.json",
          "https://github.com/JustArchiNET/ArchiSteamFarm",
          "https://github.com/JustArchiNET/ArchiSteamFarm/blob/main/ArchiSteamFarm/ArchiSteamFarm.csproj",
          "https://github.com/JustArchi",
          "https://github.com/renovate[bot]",
          "https://github.com/JustArchi-ArchiBot",
          "https://github.com/dependabot-preview[bot]",
          "https://github.com/renovate-bot",
          "https://github.com/actions-user",
          "https://github.com/dependabot-support",
          "https://github.com/Abrynos",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/automation-map.json",
          "https://phishdestroy.io/steam_dossier/de/output_steam_network/network.html",
          "https://phishdestroy.io/steam_dossier/output_steam_network/raw_data.json",
          "https://partner.steamgames.com/doc/webapi_overview/auth",
          "http://web.archive.org/web/20260915025812/https://partner.steamgames.com/doc/webapi_overview/auth",
          "https://partner.steamgames.com/doc/webapi/ISteamUserAuth",
          "http://web.archive.org/web/20260829124950/https://partner.steamgames.com/doc/webapi/ISteamUserAuth",
          "https://github.com/DoctorMcKay/node-steam-tradeoffer-manager/wiki/Access-Tokens",
          "http://web.archive.org/web/20260924181824/https://github.com/DoctorMcKay/node-steam-tradeoffer-manager/wiki/Access-Tokens",
          "https://help.steampowered.com/en/faqs/view/61F0-72B7-9A18-C70B",
          "http://web.archive.org/web/20260921022227/https://help.steampowered.com/en/faqs/view/61F0-72B7-9A18-C70B",
          "https://store.steampowered.com/privacy_agreement/",
          "https://store.steampowered.com/oldnews/19618",
          "http://web.archive.org/web/20260809125516/https://store.steampowered.com/oldnews/19618",
          "https://kotaku.com/valve-explains-why-steam-customer-service-is-still-terr-1736988223",
          "http://web.archive.org/web/20250711004653/https://kotaku.com/valve-explains-why-steam-customer-service-is-still-terr-1736988223",
          "https://www.dexerto.com/counter-strike-2/valve-saves-hacked-cs2-player-threatened-with-ransom-over-300000-of-rare-stickers-3283135/",
          "https://www.dexerto.com/csgo/csgo-skins-worth-millions-allegedly-stolen-with-help-from-steam-support-staff-2066939/",
          "http://web.archive.org/web/20250818113925/https://www.dexerto.com/csgo/csgo-skins-worth-millions-allegedly-stolen-with-help-from-steam-support-staff-2066939/",
          "https://lis-skins.com/ru/blog/krupneisaia-mosenniceskaia-sxema-v-istorii-steam/",
          "https://www.reddit.com/r/cs2/comments/1e38jo4/stealing_accounts_and_removing_vac_bans_a_new/",
          "https://www.reddit.com/r/cs2/comments/1h53qp3/steam_support_is_stealing_accounts_again/",
          "http://web.archive.org/web/20250805141942/https://www.reddit.com/r/cs2/comments/1h53qp3/steam_support_is_stealing_accounts_again/",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/outsourcing-archive-records.json",
          "https://www.dexerto.com/csgo/over-2-million-in-csgo-skins-stolen-from-hacked-steam-account-1853092/",
          "https://www.reddit.com/r/DotA2/comments/vt76ov/funds_stolen_through_steam_market_disappointed/",
          "https://esportfire.com/article/the-biggest-hack-in-csgo-history-csmoney-14082022",
          "https://escorenews.com/en/csgo/news/44087-valve-steam-support-employee-accused-of-selling-inactive-accounts-inventories-worth-six-figures-b1t-has-one-of-these-skins",
          "https://phishdestroy.io/steam_dossier/PART2_RESEARCH.md",
          "https://www.reddit.com/r/GlobalOffensive/comments/1h56shi/steam_support_is_stealing_accounts/",
          "https://www.reddit.com/r/legaladvice/comments/1kipjde/got_10k_stollen_from_steam_inventory_due_to_steam/",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/part2-quality-review.json",
          "https://phishdestroy.io/steam_dossier/de/steam_evidence_archive.html"
        ]
      },
      "source_json": "investigation_part2.content.json",
      "source_json_sha256": "26618de1892c9476d6467e1b42f44fd630d2d13d3dcc6f2e32e128ee62e388be"
    },
    {
      "source": "https://phishdestroy.io/steam_dossier/enforcement_audit",
      "language": "en",
      "title": "The census Valve won't publish — The Steam Dossier",
      "start_page": 108,
      "end_page": 118,
      "editorial_scope": {
        "policy": "Research prose, conclusions, methodological limits and analytical tables retained without paragraph truncation. Named catalogues and visual galleries are linked; raster images are not embedded.",
        "linked_sections": [],
        "raster_images_replaced": 0
      },
      "content": {
        "text": "Dieses Material ist auf Englisch verfügbar.Zurück zum Dossier · Deutsch ↗\nEXHIBIT VI — THE CENSUS VALVE WON'T PUBLISH\nEnforcement Audit — The 1,182,811 Ban Census\n\nWe didn't ask Valve how big the farm is. We counted it.\n\nWHAT THIS SECTION PROVES\n\nThis audit presents an empirical census of 1,182,811 banned accounts using Valve's official GetPlayerBans endpoint, cross-referencing commercial bot farming cohorts with documented fraud registries. It proves that over 63% of banned bots paid Valve's $5.00 store gating fee prior to enforcement, generating millions in initial revenue. Furthermore, among 51,732 convicted scammers documented in fraud registries, over 67% face zero community or trade bans—demonstrating that platform enforcement functions as commercial revenue extraction rather than victim restitution.\n\n← Back to Executive briefing\n\nThere is no published figure for how many automation accounts run on Steam. There is no need for one to be secret: the Steam ID space is a contiguous integer range and Valve hands out the Web API key that walks it. So we took the largest population that identifies itself — the ArchiSteamFarm community — and read every member once through Valve's own ban endpoint. It self-declares because ASF, on first launch, automatically joins the Steam group unless the user explicitly opts out or unchecks the group-join setting (AutoJoinSteamGroup / Statistics). Because this setting is active by default, group membership captures a broad population: active multi-account commercial bot networks, casual idling hobbyists, and ordinary players who ran the software on their personal account and never removed the default subscription. That makes its membership a working census of the software's cumulative reach: 10,880,610 total accounts (with 5,360,499 confirmed non-limited members past the $5.00 store gate). Then we asked the only question that matters — what has Valve actually done to them?\n\nWhat this page is not. It is not an argument that Valve should ban ten million people, and it is not a complaint about card farmers. Every number below is here for one reason: Valve does permanently ban individuals, and the reason it gives in writing is commercial use of Steam and automation. This measures how that same rule is applied to the same conduct at scale — by an operator whose $5.00 unlock, game licences and Market fees Valve collects on the way through. The finding is the asymmetry, not the farm.\n\nThe 10.88M countThe scammers who walk (53.5k)100k paid vs free audit\n10,880,610Total ASF group members read through Valve's own ban API (limited + non-limited combined)\n88.97%Have never been banned at all — 9,680,599 accounts still live\n63.06%Of banned accounts are paid ($5+ spend) — 100,000 SRSWOR slice (±0.39% MoE)\n67.77%Of 51,732 adjudicated scammers carry zero scam bans (full census)\n01 — The scale\nTen million accounts, and nine of ten untouched\n\nOne population that counts itself, read once through Valve's own endpoint.\n\nWHY IT SELF-COUNTS\nASF joins the group for you\n\nOn first run ArchiSteamFarm sets Statistics to true by default and joins the Archi's SC Farm Steam group. An operator has to actively opt out. So the membership is a floor on installs — not a ceiling. Operators who disabled Statistics are absent; the real install count is at least this large.\n\nWHAT WE READ\n10,880,610 total entries\n\nThe API member list returned 10,880,610 SteamID64s in total — both limited and non-limited. Steam's group page shows 5,360,499 (non-limited only). Every entry was passed once through ISteamUser/GetPlayerBans on 2026-09-23. Fifty-five minutes on one key.\n\nTHE ANSWER\n88.97% clean\n\n1,200,011 carry any Steam ban (11.03%). The other 9,680,599 have nothing on record at all — not a community ban, not VAC, nothing. The farm is not being cleared. It is being left running. The same clause, pointed at one person, is enough to remove them permanently.\n\nOf 10,880,610 accounts, how many Valve has touched\n\nThe whole scanned population, split by whether Valve has applied any ban at all. The red slice is everything Valve has ever done to this fleet.\n\n88.97%never banned\n11.03%\nNo ban of any kind — 9,680,599 (88.97%)Carries some Steam ban — 1,200,011 (11.03%)\n10,880,610ASF group members scanned\n9,680,599Never banned — 88.97%\n1,200,011Carry any ban — 11.03%\n55 minTo count all of it, on one API key\nWhat this fleet already paid Valve to exist\n\nNot an estimate of what the farm earns. A floor on what it has already spent in Valve's store — derived from Valve's own rule, applied to the count above.\n\nThe 10,880,610 count covers the full ASF group member list as returned by the API — this includes both limited and non-limited accounts. Steam's own Limited User Accounts page states that limited accounts do not count toward Steam group membership (they are excluded from the displayed group size), but they can still appear in the underlying member list. The non-limited subset — accounts that have spent at least $5.00 in the Steam store — is exactly 5,360,499 — the count Steam displays on the group page, which by Steam's own rule excludes limited accounts. The $5.00 floor calculation applies to that non-limited subset only.\n\n5,360,499non-limited members\n(Steam's displayed group count)\n×\n$5.00Valve's own minimum\nto stop being limited\n=\n$26,802,495floor on store spend\nby the non-limited subset\n\nThis is a lower bound on money already received by Valve from the non-limited fraction of the fleet — not a revenue estimate, not a profit claim. Actual spend per account is higher for most; the $5.00 figure is the minimum required threshold only.\n\nThe secondary harvest: up to 66.7% fee on farmed commodity volume. Beyond the $26.8M entrance fee, every card and commodity drop liquidating on the Community Market pays Valve a mandatory two-cent minimum fee floor ($0.01 Steam fee + $0.01 publisher fee). On typical 3-cent cards and junk items, Valve takes 2 cents out of 3 cents — an effective cut of 66.67% in Valve's favor, far exceeding the headline 15% marketing rate.\n\nCrucial population caveat: Group membership is not proof that every single account is a dedicated bot, nor does it capture every bot on Steam. ASF automatically subscribes accounts to its community group upon launch by default; unless the user explicitly unticks or disables that configuration flag (AutoJoinSteamGroup), regular players, one-time idlers, and community members remain on the roster alongside automated farming fleets. Furthermore, a Steam ban carries no public reason field. The finding is an empirical rate across this software-associated population, not an individual verdict on any single account. Aggregate, reproducible: asf-ban-census-2026-09-23.json.\n\n02 — Geography\nWhere the fleet lives\n\nOnly 8.5% of the banned accounts declare a country at all. Among the ones that do, the largest single share is the United States.\n\nA Steam profile carries an optional country field. 100,413 of the 1,182,811 banned accounts fill it in — 8.5%.† Among that minority the United States leads at 15.5%, then Ukraine, China and Russia, and the rest runs out into a long tail across Europe, Latin America and South-East Asia. Nobody verifies the field: Afghanistan sits in the top ten, which is roughly what it is worth. The other 91.5% are omitted rather than assigned, so what follows is the shape of a self-selected minority — not a map of the fleet, and not a basis for saying where it is run from.\n\nBanned accounts by declared country\n\nTop 15 countries among the 100,413 banned accounts that expose a public location. Share is of that located subset. Hover for counts.\n\n0%\n5%\n10%\n15%\n20%\nUnited States\nUkraine\nChina\nRussia\nCanada\nAustralia\nJapan\nBrazil\nGermany\nAfghanistan\nUnited Kingdom\nRomania\nFrance\nPhilippines\nIndia\n\nLocation read from GetPlayerSummaries for the banned subset. The field is set by the account holder and verified by nobody, so a VPN exit or a joke entry counts the same as a real one.\n\n03 — Freshness\nRecent accounts, not a legacy backlog\n\nDated by account-creation time, the banned population is recent, not a leftover from the trading-card era.\n\nIf this were an old mess being slowly cleaned up, the banned accounts would skew to the early trading-card years. They do the opposite. Of the 1,132,852 banned accounts that expose a creation date, 70% were created in 2020 or later, and nearly half since 2023. The count rises from 59,175 created in 2017 to a peak of 227,030 created in 2024 alone. Every one of them cleared the $5.00 store gate before it could receive a card, so the entry fee was collected on each.\n\nWhen the banned accounts were created\n\nAccount-creation year of the 1,132,852 banned members that expose a creation date. The mass is 2020–2026, not the 2013–2015 trading-card era. Peak: 2024. Hover for counts.\n\n0k\n63k\n125k\n188k\n250k\n'13\n'14\n'15\n'16\n'17\n'18\n'19\n'20\n'21\n'22\n'23\n'24\n'25\n'26\n70%Of banned accounts created in 2020 or later\n227,030Banned accounts created in 2024 — the peak year\n51,701The 2021 trough, between two peak years — unexplained\n2003→2026Range present, but the mass is the last six years\n\nCreation dates from GetPlayerSummaries for the banned subset, deduplicated by SteamID64. A creation date is when the account was made, not when it was banned or when it began farming; it is read here as evidence of how recent the population is, not of intent. Three things the chart does not show:\n\nA trend after 2024. An account made in 2025 or 2026 has had less time to collect a ban, and 2026 covers nine months — so 227,030 → 121,070 → 16,534 is censoring, not a decline.\nA ban rate. Creation years were read for banned accounts only, so there is no denominator. A growing install base alone would produce this shape.\nWhy 2021 collapsed. 51,701 sits between 105,821 and 104,641, under half of either neighbour. Nothing public explains it; it is left visible rather than smoothed.\n04 — Timing\nWhen Valve acts, it acts inside the first year\n\nThe obvious defence for 88.97% untouched is a backlog. The dated bans say otherwise.\n\nHow old the account was when the ban landed\n\nAccount age at the moment of the ban, for the 293,750 banned accounts that carry both a creation date and a dated last ban. Over half were caught inside the first year.\n\n0%\n10%\n20%\n30%\n40%\n<6 mo\n33.7%\n6–12 mo\n21.5%\n1–2 y\n20.6%\n2–5 y\n14.3%\n5 y+\n10.0%\n55.1% inside the first year\nBanned inside the first year — 55.1%Banned later — 44.9%\n0.80 yMedian age of the account when the ban arrived\n55.1%Banned inside the first year of the account\n33.7%Banned inside the first six months\n293,750Accounts where both dates are present\n\nThis is the answer to the obvious defence. If 88.97% of the fleet is untouched because enforcement is simply slow — a backlog working its way through — then the bans that do land would skew old. They do the opposite: the median banned account was nine and a half months old, and a third — 33.7% — were caught inside six months. When Valve acts on this population, it acts fast. The nine in ten still running are not waiting in a queue.\n\nAge at ban = creation date from GetPlayerSummaries subtracted from the ban date implied by DaysSinceLastBan, read on 2026-09-23. It is computed only where both values are present: 293,750 of the 1,200,011 banned accounts. The remaining accounts report no days-since value and are omitted, not assumed — so read this as the shape of the dated subset, not of every ban.\n\n05 — What the ban actually is\nWhen Valve does act, it doesn't stop the bot\n\nOf the 11% that carry any ban, look at which ban.\n\nA ban is not a ban. Of the 1,200,011 accounts Valve has flagged, 99.8% carry a community ban — a restriction on forums, profiles and groups that does nothing to a trading bot. The account can still receive cards, still trade, still move inventory. 22.2% carry at least one game ban and 3.9% a VAC ban; the categories overlap, so they do not sum. The one sanction that actually severs trading, the economy / trade ban, sits on 5,214 accounts. We are not resting the case on that number — trade bans are rare across Steam generally. The point of this chart is simpler: even the fraction Valve does touch keeps trading.\n\nWhat the 11% who are banned are actually banned for\n\nEach ban type as a share of all 10,880,610 scanned members. Accounts can carry more than one. Hover for counts.\n\n0%\n4%\n8%\n11%\n15%\nCommunity ban\nGame ban\nVAC ban\nEconomy / trade ban\n\nA Steam ban carries no reason field, so none of these bans is attributed to card farming specifically — this is the mix of ban types present, set beside what each type actually restricts. Community ban does not stop trading; the economy / trade ban does. Aggregate: asf-ban-census-2026-09-23.json.\n\n06 — The other population\nThe scammers Valve lets walk: The 51,732 Complete Census\n\nA second, independent list — community-confirmed fraud — measured against the same official API.\n\nThe automation population could be argued away as harmless idlers. The second population cannot. SteamRep is a long-running community reputation database; an account marked BANNED there has been adjudicated a scammer by that community, with documented victim proof and transaction chat logs. We completed a 100% census of all 51,732 profiles carrying that BANNED status against Steam's official Web API (ISteamUser/GetPlayerBans/v1) — and counted only the sanctions that address scamming. A VAC ban is for software cheating in a game (aimbots, wallhacks); it does nothing to a trader and is not evidence Valve acted on fraud, so it is not counted as fraud enforcement.\n\nAcross the entire 51,732-account census, 67.77% — 35,059 adjudicated scammers — carry ZERO scam-relevant bans from Valve: they can still trade, still send friend requests to new victims, still message. Only 32.23% were met with either a community or trade ban, and the trade ban — the one action that actually severs inventory transfers — sits on just 18.81% (9,731 accounts). An additional 12.81% (6,627 accounts) carry VAC or game bans purely for in-game cheating, while remaining completely unrestricted in Steam trading.\n\nConfirmed scammers, by whether Valve applied a scam-relevant ban (Full Census)\n\nAll 51,732 SteamRep-BANNED profiles, split by whether Valve applied a community or trade ban. VAC and game bans are excluded — they do not address fraud. Hover for counts.\n\n0%\n18%\n35%\n53%\n70%\nNo scam-relevant ban\nCommunity or trade ban\n0%\n6%\n13%\n19%\n25%\nCommunity ban\nTrade / economy ban\nVAC (not fraud)\nGame ban\n51,732SteamRep-BANNED profiles audited — 100% full census\n35,059Carry no scam-relevant ban (67.77%)\n18.81%Carry the trade ban that severs scams (9,731)\n32.23%The share Valve met with a community or trade ban (16,673)\n\nSteamRep is a third-party, community-adjudicated reputation database, not a Valve determination — which is the point: external evidence, measured against what Valve itself did. All 51,732 BANNED profiles from the canonical export were cross-referenced directly against ISteamUser/GetPlayerBans/v1. \"Scam-relevant\" means a community or economy/trade ban; VAC (12.81%) and game bans (3.86%) are counted separately because they address cheating, not fraud. Complete audit dataset: steamrep_steam_bans.csv.\n\nTwo populations, one finding\n\nThese are not the same people and not the same conduct. One is ten million automation accounts; the other is fifty-three thousand adjudicated scammers. What they share is the shape of the result: nine in ten farm accounts are never touched, and over two-thirds (67.77%) of confirmed scammers meet no sanction that addresses fraud. The community ban Valve does hand out freely restricts forums and profiles, not trading. The report button, the reputation database, the ban that stops a scam: all present, all under-used. Set that beside the archived refusals in the main dossier, where the same company permanently removes a single account and cites commercial use and automation as the reason — the clause is not dormant, it is pointed.\n\n07 — The $5.00 Account Gate & Account Hijacking\nThe 100,000-account empirical audit: botnets are not disposable free accounts\n\nStatistical sampling logic and mathematical proof: why taking any other 100,000 accounts yields the exact same result.\n\nValve's primary defense to regulators and consumer protection bodies has been that automated scams and farming are carried out by ephemeral, free \"throwaway\" accounts that are quickly banned. Under Valve's published rules, an account is Limited until it spends at least $5.00 USD in the Steam store, which locks it out of trading, friend requests, and API features. We audited this claim directly by testing the monetization status of a representative, mathematically rigorous sample of 100,000 banned Steam accounts drawn from our 1,182,811 profile metadata corpus.\n\nSAMPLING PROTOCOL (SRSWOR)\n100,000 Unbiased Slice\n\nDrawn from N = 1,182,811 unique banned Steam accounts using Simple Random Sampling Without Replacement via a cryptographically uniform PRNG. Every account had an identical inclusion probability of P = n / N ≈ 8.45%, completely eliminating survivorship and activity bias.\n\nMATHEMATICAL PROOF\nMargin of Error < ±0.4%\n\nApplying the Finite Population Correction (FPC) formula at a 99% Confidence Interval (Z = 2.576):\nMoE = Z × √[p(1-p)/n] × √[(N-n)/(N-1)] ≈ ±0.39%\n\nREPRODUCIBILITY\nWhy Any 100k Yields the Same\n\nBecause the margin of error is bounded under ±0.4% at 99% confidence, drawing any other independent 100,000-account sample is mathematically guaranteed to fall within 63.06% ± 0.39% (62.67% to 63.45%). The sample mirrors the entire 1.18 million banned population.\n\nThe audit results completely demolish the \"throwaway bot\" defense. Of the 100,000 accounts audited via Steam's legacy XML profile interface: 61,490 accounts (63.06% of classified accounts) are Non-Limited (Paid) accounts having spent at least $5.00 on Steam. Only 36,021 (36.94%) are limited free accounts, while 2,489 were unconfigured or private.\n\n100,000 Banned Accounts: Paid ($5+ Store Spend) vs Free Limited Status\n\nEmpirical audit of 100,000 randomly sampled banned accounts. Over 63% have cleared Valve's paid financial gate. Hover for counts.\n\n0%\n16%\n33%\n49%\n65%\nNon-limited (Paid ≥ $5.00)\nLimited (Free < $5.00)\n100,000Sampled population (SRSWOR, N=1.18M)\n63.06%Non-limited paid accounts (61,490 accounts)\n±0.39%Margin of error at 99% confidence interval\n~745,800Extrapolated paid accounts in 1.18M banned corpus\nThe Structural Reality: Industrial-Scale Account Liquidation\n\nWhy would 63% of the sampled banned accounts be paid accounts that spent real money in Valve's store? Botnet operators do not spend millions out of pocket on disposable accounts. This ratio highlights the volume of compromised and hijacked accounts circulating through the ecosystem.\n\nThis scale is directly observable on underground platforms: on marketplaces like FSB Market (an anonymized label; the original name is withheld here), over 550,000 Steam accounts (stealer logs, phishing captures, credential stuffing) are actively listed for sale at any given moment (phishdestroy.io/live-intel). The market authenticates buyers and sellers using Valve's own Steam OpenID, and neither FSB Market nor the associated forum is blocked by Valve's Link Filter.\n\nAs established in Section 06, Valve does not proactively eliminate this fraudulent activity: 67.77% of community-confirmed scammers carry zero scam bans on Steam, and 88.97% of the automation fleet remains completely untouched. The accounts circulate freely, authenticate through official APIs, and trade across the ecosystem with near-total impunity.\n\nForensic Evidence & Enforcement Architecture Diagram\nInteractive flow from 10.88M scanned accounts to 100k empirical slice and 53.5k confirmed scammers · Click links to inspect raw evidence\nTier 01 · 10.88M Automation Fleet Census\nThe largest self-identifying automation population on Steam, passed sequentially through Valve's official ban API. Proves that commercial bot fleets run with 88.97% impunity while paying tens of millions in entry fees.\n9,680,599 88.97% Active & Untouched\nAccounts running automated software that carry zero bans of any kind on record.\nRaw Census JSON (1.2 KB) ↗Inspect Section 01 ↗\n$26,802,495 Direct Store Revenue Floor\nCollected by Valve from 5,360,499 non-limited members past the minimum $5.00 entry threshold.\nCard Economy Audit ↗Valve $5 Rule FAQ ↗\n1,200,011 11.03% Flagged Subset\n99.8% carry cosmetic community bans only; trade remains open on 99.95% of accounts.\nBan Type Breakdown ↗Banned DB (60.4 MB) ↓\nTier 02 · 100,000-Account Empirical Sampling Audit (N = 1,182,811)\nRepresentative SRSWOR slice evaluated via legacy XML endpoints. Mathematically proven margin of error < ±0.4% at 99% confidence interval. Refutes the claim that banned bots are free throwaway accounts.\n61,490 (63.06%) Non-Limited Paid Accounts ($5+ Spend)\nOver 63% of banned accounts represent paid transactions. Extrapolates to ~745,800 paid accounts ($3.73M+ entry floor) in the banned pool.\nLimited Results CSV (2.1 MB) ↓100k Forensic Report ↗\n36,021 (36.94%) Limited Free Accounts (< $5.00)\nThe minority of banned profiles that fit Valve's \"disposable throwaway bot\" profile. 2,489 accounts were unconfigured/private.\n100k Sample Slice CSV (8.5 MB) ↓Spend Analysis MD ↗\n34.67% vs 63.93% Profile Sanitization Audit\nValve wiped nicknames to raw SteamID64 on 34,673 accounts, but left custom names & avatars completely untouched on 63,928 banned accounts.\nSanitization Section ↗Overview Roadmap ↗\n34.59% Legacy Aged Accounts (Created 2003–2019)\nOver a third of banned accounts were registered 5 to 20+ years ago, proving industrial-scale account hijacking of long-term Steam players.\nAge Chronology ↗Support Refusals ↗\nTier 03 · 51,732 SteamRep Confirmed Scammers Census\nFull 100% census of community-adjudicated fraudsters with victim chat logs and trade proof, cross-referenced against official Steam ban APIs. Proves systemic enforcement failure.\n35,059 (67.77%) Zero Scam Bans (Full Impunity)\nOver two-thirds of verified fraudsters carry neither Community nor Trade bans from Valve. Fully operational to trade and add victims.\nSteamRep API Bans (2.6 MB) ↓SteamRep Audit Report ↗\n9,731 (18.81%) Economy / Trade Bans\nThe only sanction that severs inventory liquidation. Present on less than a fifth of confirmed scammers.\nSteamRep Source (2.1 MB) ↓Inspect Section 06 ↗\n6,627 (12.81%) Irrelevant Cheating Bans (VAC Only)\nBanned for aimbots/wallhacks in games, while their Steam trade and phishing capabilities remain 100% active.\nVAC Irrelevance Analysis ↗Security Timeline ↗\nTier 04 · Wiki Defacement & August 2026 Infrastructure Breaches\nInternal developer documentation defacement, community editor suppression, and unsealed perimeter failures documented in the evidence pack.\n1,200+ Editors VDC Wiki Conflict Logs\nCommunity editors trying to fix phishing links and spam templates were systematically blocked by automated filters while Valve staff ignored warnings.\nRussian Conflicts Report (127 KB) ↗Classification Report (66 KB) ↗\n12 TB Unauthenticated August 2026 Asset Leak (CWE-284)\nValve hosted 12 Terabytes of internal code and prototype builds on an open public endpoint without authentication for weeks.\nValve Incompetence Dossier (43 KB) ↗Evidence Archive ↗\nCEVA Logistics Breach August 2026 Customer PII Leak\nNames, addresses, and phone numbers of European Steam Deck purchasers leaked from Valve's logistics partner, sparking phishing waves.\nIncident Record ↗Enforcement Record ↗\n\nSampling artifact: banned_100k_slice.csv (100,000 accounts). Audit outputs: slice_100k_limited_results.csv. Full analytical report: BANNED_100K_FORENSIC_ANALYSIS.md.\n\n08 — Method and limits\nHow this was read, and what it does not claim\n\nThree public populations, one public API, rigorous statistical sampling.\n\nEXECUTION & CREDENTIALS\n\nThe ASF census, the 100,000-account SRSWOR slice and the SteamRep cross-check were executed by PhishDestroy participants under their own Steam accounts and Web API keys, as part of the Coalition's public phishing and scam-banning work. The dossier author holds no Steam Web API key and performed no live scan personally. Aggregation, hashing, verification and publication were done from the participants' output.\n\nPopulation\tWhere it came from\tWhat was read\nASF members\n10,880,610\tThe public member list of the ArchiSteamFarm Steam Community group. Steam's group page shows 5,360,499 members (non-limited only); the API member list returned 10,880,610 total entries including limited accounts. The group is auto-joined on first run unless the user explicitly disables the default group-join setting in configuration (AutoJoinSteamGroup / Statistics), meaning the member list includes commercial bot clusters, individual card idlers, and regular gamers who left the default option enabled.\tGetPlayerBans for every member (ban flags); GetPlayerSummaries for creation dates and country. Batched at 100 IDs, deduplicated by SteamID64.\n100k Banned Accounts SRSWOR Slice\n100,000\tA representative sample drawn uniformly at random without replacement from the 1,182,811 banned accounts corpus ($P = 8.45\\%$). Finite Population Correction yields a margin of error of $\\pm 0.39\\%$ at a 99% confidence level ($Z = 2.576$).\tMonetization and limited account status (isLimitedAccount) audited via Steam's legacy XML profile interface (?xml=1) over distributed proxy pipelines. Confirms 63.06% paid status.\nSteamRep scammers\n51,732\tComplete 100% census of all profiles marked BANNED in the SteamRep community reputation database (51,732 total profiles). Zero sampling or filtering applied.\tISteamUser/GetPlayerBans/v1 for all 51,732 accounts, cross-tabulated against SteamRep status. Confirms 67.77% walk free of any scam bans.\nWhat is claimed\n\nOnly empirical rates and statistically bounded estimates. In the automation population, 88.97% carry no ban; the banned subset skews recent (70% since 2020). In the 100,000-account empirical audit, 63.06% of banned accounts are paid (non-limited), with a mathematically proven margin of error under ±0.4%. Among 51,732 confirmed scammers, 67.77% carry no scam-relevant ban. Every figure is reproducible from Valve's own Web API.\n\nWhat is not claimed\n\nA Steam ban carries no reason field, so no ban here is attributed to a specific cause. Group membership is not proof that an account is an automated bot: because ASF enables group-joining by default unless manually unticked, the population mixes commercial multi-account farms with personal accounts of ordinary players and hobbyists. Country is self-reported, and a SteamRep listing is a community adjudication, not a court finding. No individual is named.\n\nWhy it matters\n\nValve holds the same API, its own database behind it, and the ban reasons this scan cannot see. It can run this query across the whole ID space in seconds. The measurement that lets an outside party check an enforcement claim against a number has never been published by the one party that can produce it at full fidelity. This is the outside estimate, offered so the question can be put with a figure attached.\n\nRead next: the card economy this population runs → · support access and theft → · the full dossier →",
        "headings": [
          {
            "level": 1,
            "id": null,
            "text": "Enforcement Audit — The 1,182,811 Ban Census"
          },
          {
            "level": 2,
            "id": null,
            "text": "Ten million accounts, and nine of ten untouched"
          },
          {
            "level": 3,
            "id": null,
            "text": "ASF joins the group for you"
          },
          {
            "level": 3,
            "id": null,
            "text": "10,880,610 total entries"
          },
          {
            "level": 3,
            "id": null,
            "text": "88.97% clean"
          },
          {
            "level": 3,
            "id": null,
            "text": "Of 10,880,610 accounts, how many Valve has touched"
          },
          {
            "level": 3,
            "id": null,
            "text": "What this fleet already paid Valve to exist"
          },
          {
            "level": 2,
            "id": null,
            "text": "Where the fleet lives"
          },
          {
            "level": 3,
            "id": null,
            "text": "Banned accounts by declared country"
          },
          {
            "level": 2,
            "id": null,
            "text": "Recent accounts, not a legacy backlog"
          },
          {
            "level": 3,
            "id": null,
            "text": "When the banned accounts were created"
          },
          {
            "level": 2,
            "id": null,
            "text": "When Valve acts, it acts inside the first year"
          },
          {
            "level": 3,
            "id": null,
            "text": "How old the account was when the ban landed"
          },
          {
            "level": 2,
            "id": null,
            "text": "When Valve does act, it doesn't stop the bot"
          },
          {
            "level": 3,
            "id": null,
            "text": "What the 11% who are banned are actually banned for"
          },
          {
            "level": 2,
            "id": null,
            "text": "The scammers Valve lets walk: The 51,732 Complete Census"
          },
          {
            "level": 3,
            "id": null,
            "text": "Confirmed scammers, by whether Valve applied a scam-relevant ban (Full Census)"
          },
          {
            "level": 4,
            "id": null,
            "text": "Two populations, one finding"
          },
          {
            "level": 2,
            "id": null,
            "text": "The 100,000-account empirical audit: botnets are not disposable free accounts"
          },
          {
            "level": 3,
            "id": null,
            "text": "100,000 Unbiased Slice"
          },
          {
            "level": 3,
            "id": null,
            "text": "Margin of Error < ±0.4%"
          },
          {
            "level": 3,
            "id": null,
            "text": "Why Any 100k Yields the Same"
          },
          {
            "level": 3,
            "id": null,
            "text": "100,000 Banned Accounts: Paid ($5+ Store Spend) vs Free Limited Status"
          },
          {
            "level": 3,
            "id": null,
            "text": "The Structural Reality: Industrial-Scale Account Liquidation"
          },
          {
            "level": 2,
            "id": null,
            "text": "How this was read, and what it does not claim"
          },
          {
            "level": 3,
            "id": null,
            "text": "What is claimed"
          },
          {
            "level": 3,
            "id": null,
            "text": "What is not claimed"
          },
          {
            "level": 3,
            "id": null,
            "text": "Why it matters"
          }
        ],
        "links": [
          "https://phishdestroy.io/steam_dossier/de/enforcement_audit.html",
          "https://phishdestroy.io/steam_dossier/de/#briefing-heading",
          "https://help.steampowered.com/en/faqs/view/71D3-35C2-AD96-AA3A",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/asf-ban-census-2026-09-23.json",
          "https://phishdestroy.io/steam_dossier/VALVE_EVIDENCE_PACK/databases/steamrep_steam_bans.csv",
          "https://phishdestroy.io/live-intel/?category=steam",
          "https://phishdestroy.io/steam_dossier/de/card_economy.html",
          "https://phishdestroy.io/steam_dossier/VALVE_EVIDENCE_PACK/databases/banned_archiasf_massive.csv",
          "https://phishdestroy.io/steam_dossier/VALVE_EVIDENCE_PACK/databases/slice_100k_limited_results.csv",
          "https://phishdestroy.io/steam_dossier/VALVE_EVIDENCE_PACK/reports/BANNED_100K_FORENSIC_ANALYSIS.md",
          "https://phishdestroy.io/steam_dossier/VALVE_EVIDENCE_PACK/databases/banned_100k_slice.csv",
          "https://phishdestroy.io/steam_dossier/VALVE_EVIDENCE_PACK/reports/STEAM_BANNED_LIMIT_ANALYSIS.md",
          "https://phishdestroy.io/steam_dossier/VALVE_EVIDENCE_PACK/INVESTIGATION_OVERVIEW.md",
          "https://phishdestroy.io/steam_dossier/de/support_canned_refusals.html",
          "https://phishdestroy.io/steam_dossier/VALVE_EVIDENCE_PACK/reports/STEAMREP_VS_STEAM_AUDIT.md",
          "https://phishdestroy.io/steam_dossier/VALVE_EVIDENCE_PACK/databases/SteamRep_Profiles_BannedCaution_2024.csv",
          "https://phishdestroy.io/steam_dossier/de/security_timeline.html",
          "https://phishdestroy.io/steam_dossier/VALVE_EVIDENCE_PACK/reports/russian_conflicts_report.json",
          "https://phishdestroy.io/steam_dossier/VALVE_EVIDENCE_PACK/reports/classification_report.json",
          "https://phishdestroy.io/steam_dossier/VALVE_EVIDENCE_PACK/reports/VALVE_INCOMPETENCE_REPORT.md",
          "https://phishdestroy.io/steam_dossier/de/steam_evidence_archive.html",
          "https://phishdestroy.io/steam_dossier/de/steam_enforcement_evidence.html",
          "https://phishdestroy.io/steam_dossier/de/#insider-threat",
          "https://phishdestroy.io/steam_dossier/de/"
        ]
      },
      "source_json": "enforcement_audit.content.json",
      "source_json_sha256": "d19ada61e47a553d40259b0f43009f9428275652b82591bcae5432460b06fa42"
    },
    {
      "source": "https://phishdestroy.io/steam_dossier/card_economy",
      "language": "en",
      "title": "The card economy — The Steam Dossier",
      "start_page": 119,
      "end_page": 140,
      "editorial_scope": {
        "policy": "Research prose, conclusions, methodological limits and analytical tables retained without paragraph truncation. Named catalogues and visual galleries are linked; raster images are not embedded.",
        "linked_sections": [],
        "raster_images_replaced": 0
      },
      "content": {
        "text": "EXHIBIT V — THE CARD ECONOMY\nThe Card Economy — Wholesaling, Drop Limits & Automated Farming\n\nA bot farm is not a leak in Valve's store. It is a customer.\n\nWHAT THIS SECTION PROVES\n\nThis chapter proves that automated Steam card farms operate as structural, revenue-generating wholesale customers rather than unauthorized exploiters. Every farming bot must clear Valve's $5.00 activation threshold, purchase game licenses, and generate guaranteed market transaction fees (floored at $0.02, extracting up to 66.7% fee rates on low-value assets). Despite explicit Terms of Service prohibitions against automated bot networks, 91 audited commercial bot networks openly maintain 694,673 complete card sets across Steam's ecosystem without enforcement interference.\n\n← Back to Executive briefing\n\nA Steam account cannot receive a single trading card until it has spent $5.00 in the store. It cannot farm a game it does not own, and it cannot farm one it was given free. So before an automated card farm produces anything at all, it has bought its way in — per account, at a price Valve publishes. Then Valve's automation clause names, line by line, exactly what that farm produces; its licence forbids every route by which a farmed card turns into money; and its market takes a cut when the card goes anyway — advertised at 15%, but floored at two cents a sale, which on a card priced in cents is most of the price. This exhibit measures how large that trade is, what the level at the top of a profile costs in sets, and what Valve's enforcement desk does with the same clause when the account belongs to an ordinary trader.\n\nWhat a farm has to buy firstWhat a level costs in setsBoth sides of the deskWho moderates the card economy\n$5.00Store spend before an account can receive any card — Valve's own support page\n13,876Games on Steam that issue trading cards, holding 99,971 distinct card types\n694,673Complete card sets held in stock right now by 91 publicly listed trading bots\n1,389,346Account-and-game card drop allowances that stock has already consumed, at minimum\n$9.99Median price of a card-bearing game — its finished set sells for a median of $0.74\n97,114Members of the card-trading group whose moderator list carries a Valve employee — § 08\n01 — The process\nWhat a farm actually is, step by step\n\nDescribed only from the tool's own documentation and Valve's own support pages. Nothing in this section is inferred, and nothing in it is disputed by either party.\n\nStep 1\nBuy in\n\nThe account must not be limited. Valve's support page bars limited accounts from \"Participating in the Steam Market\", from \"Trading Steam Community items (trading cards, booster packs, gems, etc.)\" and from \"Gaining Steam Profile Levels (Locked to level 0) and Trading Cards\". The gate is money: \"You will need to spend at least $5.00 USD within the Steam store.\"\n\nStep 2\nBuy games\n\nCards drop only from owned games. \"You need to own the game on your Steam account in order to be eligible for any card drops from it. Family sharing is not ownership and doesn't count.\" The free routes are closed too: \"Paid games that you've obtained for free during a promotion can't be farmed for card drops\", and \"You can't drop cards from F2P games without spending any money in them.\"\n\nStep 3\nIdle\n\nThe tool logs the account into the Steam network headlessly, \"parses your badges\", builds the list of farmable titles and starts \"playing eligible game and periodically checking if game is fully farmed already.\" Its maintainer's description of the mechanism: it \"does not do anything else than telling Steam we're playing given game.\"\n\nStep 4\nDrops run out\n\nEach title is finite. \"Every game has fixed number of card drops. Once you drop all of them (around a half of the full set), the game is not a candidate for farming anymore.\" A farm that wants to keep producing has to keep buying titles. Card supply is throttled by purchases — by design, and in Valve's favour.\n\nStep 5\nCash out\n\nThe card leaves by one of three doors: sold on the Community Market, traded away, or crushed into gems. Each is a Subscription Marketplace transaction or a trade, and § 3.D reserves the charge: \"Valve may charge a fee for transactions in a Subscription Marketplace.\" This is the step that makes the whole thing a breach — see 05.\n\nSources, read and quoted verbatim on 2026-09-22: Steam Support — Limited User Accounts ↗ · ArchiSteamFarm FAQ ↗ · Valve — Steam Trading Cards FAQ ↗ · Steam Subscriber Agreement ↗ archived 2026-09-24 ↗. ArchiSteamFarm is used throughout this page as a measuring instrument, not as a defendant; its own documentation states plainly that \"ASF is not authorized by Valve\".\n\n02 — The scale\nBefore a farm earns a cent, it has already paid Valve\n\nBecause a limited account cannot receive a card, every account in a farm must be bought out of limited status before it produces anything. The threshold is published, and it is charged per account.\n\nFarm size\tWhere the number comes from\tMinimum store spend to make them card-eligible\n10 accounts\tThe ceiling ASF recommends — \"based on internal Valve guidelines, as well as our own suggestions\"\t$50\n100–200 accounts\tTechnical ceiling in the same FAQ: \"you can run up to 100-200 bots with a single IP and a single ASF instance\"\t$500 – $1,000\n120 accounts\tEnforcement case 3 below — permanently banned\t$600\n170 accounts\tEnforcement case 2 below — permanently banned during the 2017 Winter Sale\t$850\n1,000 accounts\tEnforcement case 1 below — trade banned\t$5,000\n5,000 accounts unverified\tOperator scale reported to this investigation and not independently checked — see the note on sourcing\t$25,000\n10,000 accounts unverified\tOperator scale reported to this investigation and not independently checked — see the note on sourcing\t$50,000\n\nThe last two rows are the only figures on this page resting on an unverified report rather than a document — they are marked in the table, explained in the note on sourcing, and nothing else here depends on them. The right-hand column is arithmetic on Valve's published $5.00 USD threshold and nothing else. It is a floor, not an estimate of what a farm costs or of what Valve earned: it excludes the games, which must be owned and cannot have come free in a promotion, and it excludes the roughly 15% the Community Market takes when the cards are sold. No revenue figure is claimed on this page.\n\nAnd Valve has priced a card drop itself. Its Trading Cards FAQ sets the free-to-play conversion rate in plain dollars:\n\n\"Free to play games drop game cards based on your in-game purchasing. For every $9 USD spent (approximate) since the start of the Steam Trading Card Beta, you will earn one card drop.\"\n\n— Valve, Steam Trading Cards FAQ ↗ · verified verbatim 2026-09-22\n\nA trading card is not a giveaway the platform loses money on. It is something Valve sells, at a rate Valve published — and then charges a second time to sell onward. Which is why the honest description of a card farm is not parasite. It is wholesale buyer.\n\nHow large the thing being bought actually is\n\nEverything from here to the end of this section is measured, not reported. The card census is Steam Card Exchange's published badge pricelist; the prices of the games themselves come from Valve's own store API; the bot stock comes from a public bot directory that anyone can open. All three were read on 2026-09-22 and the arithmetic is given in full in section 08.\n\n13,876Games issuing cards\n99,971Distinct card types\n5 · 6 · 15Cards per set: min, median, max\n$0.74Median price of a finished set\n$23,586.57One of every set at market\nHow big a set is\n\n13,876 games by cards in the set. Valve drops about half of them to any one account.\n\n0\n1,250\n2,500\n3,750\n5,000\n5\n6\n7\n8\n9\n10\n11\n12\n13\n14\n15\nWhat the licence costs\n\nList price of the same games on Steam's store, in US dollars.\n\n0\n1,000\n2,000\n3,000\n4,000\n<$1\n$1-3\n$3-5\n$5-10\n$10-20\n$20-40\n$40+\nWhat the finished set returns\n\nMarket price of the completed set for the same games.\n\n0\n1,500\n3,000\n4,500\n6,000\n<$0.50\n$0.50-1\n$1-2\n$2-5\n$5-10\n$10+\n\nRead the second and third charts against each other and the shape of the trade is visible without arithmetic: the games cluster in the tens of dollars, the sets they yield cluster under one dollar. Both are counts of the same 13,876 games, on the same axis unit, so the comparison is between two heights and not between two scales.\n\nThat is the supply side. The demand side is the part Valve does not have to advertise, because it is already sitting in public: a single open directory of card-trading bots lists 91 bots holding 694,673 complete sets in stock at this moment. No login, no scraping of a marketplace, no private data — the stock figure is printed on the page next to each bot's name.\n\nTurn that stock into the only unit that matters here. Valve's own rule: \"Most games will drop a number of cards equal to about half the number of cards in that game's set of cards… You'll need to collect the other half of the set from other community members.\" One account can never finish a set by playing. Two, at the absolute minimum, each owning that game, each burning its once-per-game drop allowance. Drops do not regenerate.\n\n694,673Sets in stock, 91 public bots\n3,473,365Cards, at the 5-card minimum set\n1,389,346Drop allowances consumed, minimum\n2,602Accounts owning one single game, densest bot\nWhere the 694,673 sets are sitting\n\nThe twelve largest of the 91 publicly listed card bots, by complete sets in stock. The ten largest hold 248,115 sets between them — 35.7% of everything on the board.\n\n0\n11,250\n22,500\n33,750\n45,000\nCard Supply #4 (High)\nN!vq's Leveling (High)\nAlice [BOT] LEVEL-UP RARE SETS\nN!vq's Leveling (Low)\nDisco Lite Level Up\nN!vq's Leveling (Mid)\nbaty131store.net | Level Up\nKitten - Supreme\nArashirn | Level Up\nSH (Junior) Level Up\nDuobot.com - Overstock\nlvlupbot.com - godlike\n\nEvery one of those 1.39 million allowances belonged to an account that owned the game, was past the $5.00 gate, and can never produce those drops again. This is unsold inventory on ninety-one bots. It is not a measure of the market; it is a measure of what is left over after the market.\n\nThe last figure is a pigeonhole floor, not a headcount. One bot lists 14,310 sets drawn from only 11 games, so at least one of those games is represented by 1,301 sets, which is at least 2,602 distinct accounts that each bought that game. It is the smallest number the arithmetic permits, and it concerns one bot out of ninety-one.\n\nWhat this floor does and does not say\n\nThese bots buy cards from ordinary players as well as from farms — their published buy rates are the point of the directory. So the 1.39 million allowances are not a count of farm-owned accounts. They are a count of once-per-account, once-per-game drop allowances that have been spent somewhere on Steam and have ended up, unsold, in commercial stock. Whether the account behind each one was a farm or a teenager clearing their badges page does not change what Valve collected: the $5.00 unlock, the game licence, and a Market cut on every hop — not 15%, but 15% or the two one-cent minimums, whichever is larger, which on a card priced in cents is the larger by far. The arithmetic is in the fee ladder below. That is the point of this page, and it is not a complaint about farmers: the same conduct Valve charges a fee on is the conduct it cites, word for word, when it permanently bans an individual for \"commercial use\".\n\nThe figure is also a floor in a second sense. It counts only stock that is listed and unsold today on bots that choose to be in a public directory. Everything already sold, everything held privately, and every bot outside the directory is excluded.\n\nAnd farming does not pay for itself at Valve's prices\n\nThe obvious objection is that a farm buys cheap games to mint expensive cards. Steam's own store API says otherwise. Of the 13,876 card-bearing games, prices resolved for 13,713; 12,918 are paid titles with a median list price of $9.99. The median finished set sells for $0.74. Two licences are needed per set. So the median set costs roughly $19.98 of game licences to produce and returns $0.74.\n\nMeasured on 2026-09-22\tValue\tWhat it settles\nMedian list price, card-bearing game\t$9.99\tThe licence is the expensive half of the transaction, not the card\nGames priced at $4.99 or less\t3,665 (28.4%)\tEven the cheap tail is dearer than the set it yields\nCheapest card-bearing game on the store\t$0.99\tTwo licences, $1.98, for a set that typically sells under $1.30\nGames whose set sells for more than the game\t323 of 12,918 (2.5%)\tCard arbitrage against Steam's list prices exists in 1 game in 40\nFree-to-play titles in the census\t795\tAnd Valve prices each of their drops at $9 of in-game spend\n\nWhich closes the economic question in Valve's favour and against the usual story. At the prices Valve itself charges, card farming is a loss-making activity that only works on licences acquired below Steam's list price — bundles, regional pricing, key resale. The cards are the residue. The purchase is the event. And the purchase happened on Steam.\n\nWhat the farm actually props up\n\nPut the pieces together and the farm stops looking like something Valve tolerates and starts looking like something Valve needs. Every input a farm supplies is an output Valve reports or bills for. Follow one bot account outward:\n\nOne farmed accounta \"wholesale customer\", not a leak\nGame sales\n\nBuys the titles it farms — from the 13,876 card games to the $0.50 shovelware — because cards only drop from owned games.\n\n\"Online\" & playtime\n\nIdles them to drop cards, feeding the concurrent-player and hours-played figures Valve cites as engagement — the exact stat § 4.C calls \"faking playtime\".\n\nRegistrations\n\nMust clear the $5.00 limited-account gate before it can receive a card — a real store spend Valve books per account.\n\nWallet money & fees\n\nEvery card it sells routes back through the Market, where the fee reaches up to 66.7% on a low-value card and the proceeds stay locked in Steam Wallet.\n\nSteam-level PR\n\nThe badges and levels Valve showcases exist only because sets were crafted — and the top of that ladder is stocked by bots (see § 03).\n\nRemove the farm and every number above falls — the game sold fewer copies, the \"online\" was smaller, the account was never registered, the fee was never taken, and the level was never reached. That is why a rule that forbids automation coexists with millions of automated accounts: the prohibition is the option, and the activity is the revenue.\n\nAnd the cash-out itself is a value sink Valve taxes twice\n\nThe card is not the end of the loop. Valve's own mechanics let a card be crushed into gems, and gems be spent to craft booster packs — three more cards — which are sold or crushed again. Each hop is a Market transaction or a conversion, and each is taxed. The direction of that loop follows from the fee floor measured below and needs no outside model: every card sold inside it surrenders at least two cents, on cards that trade for three to five, so each turn of the crank returns less than went in. The loop destroys virtual value and forces fresh, fee-bearing transactions to replace it. No figure for the size of that loss is claimed here — the per-set return depends on gem rates and booster odds this investigation has not measured.\n\nTrading carddrops from owned game\n→\nGemscard crushed, fee taken\n→\nBooster packgems spent to craft\n→\n3 new cardssold on Market, fee taken\n↶\n\nOnly the mechanics are asserted here, and they are Valve's own — cards convert to gems, gems craft boosters, boosters yield cards — each documented in the Steam Trading Cards FAQ, and each hop a taxable Market event. Source of the loop mechanics: Valve, Steam Trading Cards FAQ ↗.\n\nThis is not a moment. It is an industry with a multi-year backbone.\n\nA single snapshot could be a fluke. So the public card-bot directory was read once per seasonal Steam sale, back through the Wayback Machine, from 2022 to 2026 — the set-stock the bots were carrying, and the same accounts, sale after sale. The economy does not appear and vanish; it persists, with a stable core of operators, and it peaked at over three million complete sets in stock during the Winter 2023 sale — on the order of a third of a million TF2 keys of value held at one moment, in one directory.\n\nComplete card sets held in the public bot directory, by Steam sale\n\nOne Wayback snapshot of steam.supply/CardBots per seasonal sale. Hover for the value in TF2 keys at that snapshot's rate.\n\n0.0M\n0.9M\n1.8M\n2.6M\n3.5M\nA’22\nS’23\nW’23\nS’24\nW’24\nS’25\nS’26\n401Distinct bot accounts seen across the sales\n59Present in 5 or more of 7 sales — the stable core\n16Present in every one of the 7 sales, 2022–2026\n3.22MPeak sets in stock (Winter 2023) ≈ $570k–790k in keys\nWhat one sale's badge ladder looks like from the top\n\nThe demand side matches the supply. On the public Summer Sale 2024 badge ladder archived 2026-07-16 ↗, the number one account had crafted the sale badge 1,740,645 times — 1.74 million ten-card sets, 17.4 million cards consumed into a single profile decoration. At the sale's own market price ($0.50 a set) that is ~$870,000 of card value; bought the way it is actually bought — TF2 keys traded to level-up bots at roughly 7.6 sets a key — it is ~229,000 keys, about $410,000–$570,000 in real terms. The number-two account: 552,000 sets, ~$130,000–181,000. No human plays for this. It is bought, and every leg of the buying is a transaction Valve clears.\n\nMethod and limits: set-stock is summed across the bots each snapshot lists; the number of bots per snapshot is not comparable across sales because some snapshots show only featured bots and some the full directory, so stock is read as a floor on what was visible, not a census. Key values use each snapshot's median advertised sets-per-key rate and a $1.79–$2.49 TF2 key. Persistence is by SteamID64 across snapshots. 2021 snapshots used an older page layout and are not included. Data: farm-economy-timeline.json; badge levels from SteamLadder; set prices from Steam Card Exchange (sale-time Wayback snapshots, $0.05 a card).\n\nAnd the same fleet is there when no sale is running\n\nThe two pictures above are not two populations. They are one fleet, photographed at different moments. The directory read at the top of this section was read on an ordinary day with no seasonal sale running — 2026-09-22 — and even at rest it held 91 bots and 694,673 complete sets: on the order of 186,000 TF2 keys, $334,000–$464,000 of card value, sitting idle between sales. That is the floor the operation carries when nothing is happening.\n\nAnd it is the same operation. Matched by SteamID64, 87 of those 91 resting bots — 96% — also appear in the seven sale snapshots above, sixteen of them in every single one. The directory is not a stall that opens for the sale and shuts afterward; it is a standing commercial inventory that this same fleet has swollen as high as 3.22 million sets at the Winter 2023 peak and never lets fall to zero. A sale is when it sells. It exists the rest of the year too.\n\nThe resting directory, bot by bot\n\nEach square is one bot in the directory on 2026-09-22, highlighted if it also appears in the seven sale snapshots. 91 is what the directory listed that day, not the size of the fleet — 401 distinct accounts appear across the sale snapshots, and the directory shows a different slice on different days.\n\nSeen in past sales (87) New since last snapshot (4)\n\nNon-sale baseline read 2026-09-22 from the same public directory, no login. Resting value uses each bot's own advertised sets-per-key rate and the $1.79–$2.49 key band above. Overlap is by SteamID64 against the seven sale snapshots. Because featured-vs-full listing differs by snapshot, this compares stock and identity, not headcount. Arithmetic in section 08.\n\n03 — The ladder\nThe other product is the number next to your name\n\nCards are the raw material. The finished good is a Steam Level, and Valve set its price in sets.\n\n100Steam Level\nTarget level — drag or use the arrow keys\nPrice of one complete set, USD\n\n$0.20 is the cheapest complete set in the census, $0.74 the median, $1.70 the mean. The figure covers the cards only — never the $5.00 unlocks or the game licences.\n\n55,000XP required\n550Complete sets consumed\n110Games to own, farming it yourself\n$407.00Cost of the cards at that price\n1,100Drop allowances burned, minimum\n$5,500.00$5.00 unlocks, if no account is reused\nComplete sets consumed, level 1 to 1,000\n\nOne badge craft = one complete set = 100 XP. Each level inside a block of ten costs 100 XP more than the block below it.\n\n0\n12,625\n25,250\n37,875\n50,500\n1\n250\n500\n750\n1000\n667\n550 sets\n\nA level is not decoration that Valve leaves alone. It is wired into the account. From Valve's own Trading Cards FAQ, on what crafting a badge gives you: \"100XP, which may increase your Steam Level. If your Steam Level increases, the limit on the size of your friends list will be increased by five, and potentially you'll unlock the ability to customize your profile with showcases.\" And on booster packs: \"your Steam Level increases your rate of receiving a booster pack drop: Level 10: +20%… Level 50: +100% increase in your drop rate (i.e. the rate has doubled).\"\n\nSo the level buys two things Valve controls: how many people you are allowed to be friends with, and how fast free cards fall into your inventory. The second one compounds — the more sets you have consumed, the faster the platform hands you more material. Valve built the reinvestment loop into the product.\n\nThe exchange rate is fixed and published. One badge craft consumes one complete set and yields 100 XP; \"You can craft a set for the same game at most five times.\" The XP a level costs rises every ten levels. That produces the following, and nothing here is an estimate:\n\nSteam Level\tComplete sets it consumes\tGames you must own to craft them yourself\tAt the cheapest set on record ($0.20)\tAt the median set ($0.74)\tScale\n10\t10\t2\t$2.00\t$7.40\t\n50\t150\t30\t$30.00\t$111.00\t\n100\t550\t110\t$110.00\t$407.00\t\n200\t2,100\t420\t$420.00\t$1,554.00\t\n500\t12,750\t2,550\t$2,550.00\t$9,435.00\t\n667\t22,579\t4,516\t$4,515.80\t$16,708.46\t\n\n667 is not a hypothetical. It is the highest level a single bot in the public directory advertises it can take a customer to, out of the 33,359 sets it holds across 6,117 games. The fourth column is the same ladder priced against the cheapest complete set anywhere in the census; the fifth against the median. Both are market prices for the cards alone and exclude the $5.00 unlock and the game licences entirely.\n\nHow the curve was checked, because Valve does not publish it\n\nValve states the badge rate (\"every 100 XP gives you an added Steam Level\") and then hedges it — \"(at least to start)\" — without publishing the escalation. The curve used above is the standard one, in which each level inside a block of ten costs 100 XP more than the block below it. It was verified against the directory rather than assumed: for every bot whose advertised maximum is limited by its stock rather than by the five-crafts-per-game cap, the level computed from this curve matches the level the bot advertises exactly — 541 against 541, 494 against 494, 464 against 464. Where the cap binds instead, the computed figure runs a few levels high, which is what a cap that also depends on per-game stock depth should do. No claim is made about the curve above level 667.\n\nRead the ladder next to section 02 and the shape of the business is visible. To put one account at level 500, somebody must assemble 12,750 complete sets. Each of those sets took at least two accounts' drop allowances, each of those accounts had crossed the $5.00 gate, and each owned the game. One vanity number at the top of one profile rests on at least 25,500 spent drop allowances underneath it. Valve is not losing that trade. Valve is the counterparty to every leg of it.\n\n04 — The statistics\nThe clause does not describe farming vaguely. It lists it.\n\n§ 4.C is not a general anti-bot sentence. Its enumerated examples name, one after another, the two things a card farm produces.\n\n\"You may not use any form of scripts, bots, macros, or other non-human-controlled systems ('Automation') to interact with Content and Services on Steam in any manner, including but not limited to:\n\nAutomating the Steam account creation process,\nFaking gameplay statistics (e.g., inflated wins or losses, XP, playtime),\nEarning rewards or progress without genuine user input,\nParticipating in adjudication systems (like peer reviews or 'overwatch') through automated means, including influencing outcomes or reporting users by scripted action rather than informed judgment.\"\n— Steam Subscriber Agreement § 4.C ↗ archived 2026-09-24 ↗ · retrieved and quoted verbatim 2026-09-22\n\"…playtime\"\n\nIdled hours are not phantom hours. The ASF FAQ answers the question head-on — \"Why playtime of games farmed through ASF doesn't increase?\" — with: \"It does, but not in real-time. Steam records your playtime in fixed intervals and schedules update for it… it's usually updated every 30 minutes or so.\"\n\nThose hours land in Valve's records, on Valve's store pages, and in the concurrent-player counts Valve publishes on its own Steam Charts ↗ archived 2026-09-23 ↗. In those figures an idling account is indistinguishable from a playing one. The engagement numbers the platform quotes outward are computed over a population that includes, by the platform's own rule, accounts that are not playing.\n\n\"…without genuine user input\"\n\nThat is a definition of an idled card drop, written by Valve. It is also a definition of the Steam Level, the badge, the booster-pack eligibility and the profile XP that come with it — the ASF FAQ confirms the tool \"preserves ability to receive booster packs\", because it logs in the same way the official client does.\n\nSo the reward system and the prohibited act are one mechanism seen from two sides. Valve built the reward to be produced by time rather than by skill, then wrote a clause forbidding the production of rewards by anything other than a person spending that time.\n\n05 — The commercial-use trap\nEvery exit from a farmed card is an exit the licence forbids — and Valve charges a fee at the door\n\nThis is the part that cannot be solved by farming \"responsibly\". The licence is for personal, non-commercial use, and a card only becomes worth farming at the moment it stops being personal.\n\n§ 2.A — the licence\n\n\"Valve hereby grants, and you accept, a non-exclusive license and right, to use the Content and Services for your personal, non-commercial use (except where commercial use is expressly allowed herein or in the applicable Subscription Terms).\"\n\n§ 2.G — the restriction\n\n\"you are not entitled to: … (iii) exploit the Content and Services or any of its parts for any commercial purpose, except as expressly permitted elsewhere in this Agreement (including any Subscription Terms or Rules of Use).\"\n\n§ 3.D — the fee\n\n\"Valve may charge a fee for transactions in a Subscription Marketplace. Any fees will be disclosed to you prior to the completion of the transaction.\"\n\nRead the three together and the position closes\n\nA card that is kept is worthless to a farm. A card that is sold, traded or crushed into gems has been used to produce value — and Valve has said in its own enforcement letter what it calls that: the operator of 170 bots was told the account \"was used to illegally collect collectible cards on Steam, as well as related and not only commercial activities.\" In that case the cards reached the market. The sales cleared. The fee was taken. The ban came afterwards.\n\nThe fee at that door is not 15%. On a farmed card it reaches two-thirds.\n\n§ 3.D reserves \"a fee\". On the cards a farm actually produces, that fee is nothing like the advertised ~15%. The Community Market takes a 5% Steam transaction fee and a 10% game fee, each with a floor of $0.01 (Valve's own Community Market FAQ). On a card listed for one cent those floors are the price: the buyer pays three cents, two of which are fees. The rounding floor turns the headline 15% into an effective levy that climbs to 66.7% exactly where the card market lives — a few cents a card.\n\nEffective fee on a Community Market sale, by the seller's asking price\n\n5% Steam + 10% game, each a minimum of $0.01. The shaded band is where trading cards actually trade — roughly $0.03–$0.05 a card.\n\n0%\n10%\n20%\n30%\n40%\n50%\n60%\n70%\ncards\n$0.01\n$0.10\n$0.20\n$0.30\n$0.40\n$0.50\n66.7%\nSeller wants\tSteam 5% (min $0.01)\tGame 10% (min $0.01)\tBuyer pays\tCombined fee\n$0.01\t$0.01\t$0.01\t$0.03\t66.7%\n$0.03\t$0.01\t$0.01\t$0.05\t40.0%\n$0.05\t$0.01\t$0.01\t$0.07\t28.6%\n$0.08\t$0.01\t$0.01\t$0.10\t20.0%\n$1.00\t$0.05\t$0.10\t$1.15\t13.0%\n\nThe 10% game fee goes to the app that issued the card; the 5% is Valve's own, and on Valve's own titles and base inventory items the whole fee is Valve's. Either way the money leaves the farmer — selling a three-cent card returns one cent and surrenders two. Multiply that by the hundreds of thousands of sub-five-cent card sales a farm generates and \"the fee Valve may charge\" is the business model, not a footnote. Source: Steam Community Market FAQ — Fees ↗ archived 2026-09-21 ↗, read 2026-09-22; the curve is arithmetic on those two published rates and their $0.01 floors.\n\nThere is no configuration of the tool that escapes this. It can be run by one person, on one account, with perfect restraint — and the moment that person sells a single farmed card for wallet funds, the same sentence in § 2.G reaches them as reaches the operator of ten thousand. Valve has therefore reserved a breach it could invoke against effectively every card seller on its own market, and has declined to invoke it against effectively all of them. A rule enforced at that rate is not a rule. It is an option. The question this exhibit puts is not why card farmers are tolerated; it is why the same option is exercised against a lone user who sells a card, while the commercial card economy those cards feed — the trading services, the level-up bots, the bulk sellers — runs on in the open, one of its largest groups moderated by a Valve employee (§ 08). The breach is reserved against the small holder and waived for the machine.\n\n06 — The enforcement record\nNo notice, in waves, and it travels down the phone number\n\nValve wrote the no-notice power into the agreement itself, one clause after the automation clause.\n\n\"Valve may restrict or terminate your Account(s) or a particular Subscription for any conduct or activity that is illegal, constitutes a Cheat or Automation or breaches the Steam Online Conduct Rules. You acknowledge that Valve is not required to provide you notice before terminating your Subscription(s) and/or Account.\"\n\n— Steam Subscriber Agreement § 4.D ↗ archived 2026-09-24 ↗ · verified verbatim 2026-09-22\n\n1,000+ bots · trade banned. \"It looks like this account was used to manage a network of bot accounts. Botting is a violation of the Steam Subscriber Agreement.\"\n\n170+ bots · permanently banned, 2017 Winter Sale. \"this account was used to illegally collect collectible cards on Steam, as well as related and not only commercial activities. The account has been permanently blocked and Steam Support can not provide additional support on this issue.\"\n\n120+ bots · permanently banned. \"This and other accounts were used for flooding our network infrastructure, which is a violation of Steam online conduct.\"\n\n— Steam Support messages reproduced in the ArchiSteamFarm FAQ, section \"Did anybody get banned for it?\". Source ↗ · verified verbatim 2026-09-22\nCase 4 — June 2025, VAC bans on idled CS2\n\nA later episode than the three above is recorded in the project's own tracker: accounts that had only idled Counter-Strike 2 through the tool received VAC bans — the anti-cheat kind, not the administrative kind. The maintainer's position is that idling cannot cause one, since it \"does not do anything else than telling Steam we're playing given game.\" The cause is disputed. That the accounts were banned is not.\n\n— ArchiSteamFarm discussion #3440, opened 26 June 2025 ↗ · read 2026-09-22\n\nHow a main account dies\n\nIn the same thread a project collaborator describes the propagation rule: accounts can be banned \"by chain\", if they are using same phone number — \"it may be just one VAC ban, propagated to 'clean' accounts connected to the banned one.\"\n\nSteam Guard requires a phone number. Farms are built on the operator's phone number. So enforcement does not stop at the disposable accounts: it walks up the shared identifier to the account holding the library, the friends list and the inventory. That is the mechanism one project collaborator describes for how a single action removes an operator's main account along with the farm — and it is why the loss in an enforcement wave is not measured in $5 accounts. (Described by a project contributor in ASF GitHub discussion #3440; there is no official Valve confirmation or formal precedent on record.)\n\nThe same paragraph, five years apart, from three different agents\n\nThe clause that makes farming a breach — commercial use of a personal, non-commercial licence — is not reserved for farms. It is the standing reason Steam gives when it closes an account over trading, and the reason arrives as a template. Below are three instances, published by the people who received them, five years apart, from three different named agents.\n\nMessage from Steam Support on Sep 29 @ 7:56pm\n\n\"The account you are writing in for has been locked for violating the terms of the Steam Subscriber Agreement. The account has been identified as being used for commercial purposes based on trading, community reports, and other factors.\n\nThis lock is permanent and Steam Support cannot help you further with this.\n\nBecause we have provided all the information we have I am closing this help request. Please note you will not receive further replies regarding this issue.\n\nRegards,\nHal\"\n\nThis help request has been closed.\n29 September 2020. Posted by the recipient with the comment \"RIP Trading.\" — @gergelyszabo94 ↗\nMensagem do Suporte Steam em 12 de jul. às 22:41\n\n\"The account you are writing in for has been locked for violating the terms of the Steam Subscriber Agreement. The account has been identified as being used for commercial purposes based on trading, community reports, and other factors.\n\nThis lock is permanent and Steam Support cannot help you further with this.\n\nBecause we have provided all the information we have I am closing this help request. Please note that future help requests submitted regarding the account lock may be closed without a reply.\n\nSteam Support\nVido\"\n\nEste pedido de ajuda foi encerrado.\n12 July 2024, Portuguese interface. The recipient is a professional CS2 player: \"already contacted steam support but only getting auto-responses… can't play faceit and also can't play professional matches.\" — @prcs25 ↗ archived 2024-07-15 ↗\nQuoted by the recipient, r/steamsupport\n\n\"Hello, The account you are writing in for has been locked for violating the terms of the Steam Subscriber Agreement. The account has been identified as being used for commercial purposes based on trading, community reports, and other factors.\n\nThis lock is permanent and Steam Support cannot help you further with this.\n\nBecause we have provided all the information we have I am closing this help request. Please note that future help requests submitted regarding the account lock may be closed without a reply.\n\nSteam Support\nSally\"\n\nReceived three times, on three separate requests.\n29 March 2025. The writer was not appealing the lock — their account had been stolen along with their email and they were asking for access: \"I'm not asking about the ban and I'm not disputing it I just want access to my steam account… Valve have given me this exact answer copy and pasted on every request and close the request.\" — r/steamsupport ↗, held in this investigation's own complaint corpus\n\nWord for word, comma for comma, across fifty-five months, three agents and two interface languages. The only edit anywhere in the body is the final sentence hardening between 2020 and 2024, from \"you will not receive further replies\" to \"future help requests… may be closed without a reply.\" Whatever process produced these decisions, the letter is not a record of it. The stated grounds are \"trading, community reports, and other factors\" — a category, a report of unknown origin, and an unnamed remainder.\n\nFive further cases, collected the same way. The first three are the same category and the same outcome; the last two are the same desk answering a different rule in the same words:\n\nDate\tWhat the account did\tWhat happened\tSource\n04.12.2021\tBuying and selling on Buff — \"I've done nothing else than some buying and selling on buff aka P2P trading\"\tCommunity ban: no market, no trading, expensive inventory frozen\tr/csgomarketforum ↗ archived 2025-03-27 ↗\n06.12.2021\tOne-way P2P trades through Buff and Bitskins for loadouts and trade-ups\tPermanent commercial-use lock plus community lock: \"stuck in a pseudo invisible mode… My profile is also stuck on private\"\tr/GlobalOffensiveTrade ↗ archived 2021-12-06 ↗\n20.12.2024\tAccount held since 2017, thousands of hours; trades on community marketplaces for themed loadouts and trade-ups\tPermanent lock with community lock, no prior warning or strike; support \"say their decision is final\", replies are automated\tr/csgomarketforum ↗ archived 2025-06-27 ↗\n23.12.2024\tReturning user adds wallet funds after a year away, over a VPN used \"only for general internet security\"\tPermanent community ban with no reason given at all: \"the ban is permanent and they cannot provide further information and that further tickets may be closed without response.\" 196 upvotes, 340 replies\tr/steamsupport ↗\n04.08.2026\tYears of purchases from Iran; the writer states they never posted, never used the Market, never used the forums\tCommunity access locked until 2038 over \"sanctioned regions\"; ticket closed by an agent named Azul. The same account's refund from the same Iranian IP had been approved a year earlier. The library and the money stay with Valve.\tr/pcgaming ↗\n\nThe last row is a different rule from the rest — sanctions compliance, not commercial use — and it is included because the shape of the answer is identical: a category, no evidence, no appeal, a closed ticket. It also raises a question the others do not. If the account was unlawful to serve, the years of payments were unlawful to accept. One of those two positions has to be wrong, and only one of them cost the customer anything.\n\nAll eight were read on 2026-09-22 — the 2021 and December-2024 threads through Internet Archive snapshots and the rest through a public Reddit front end, because Reddit refused direct requests from the collecting host. The two 2020 and 2024 letters are transcribed from the screenshots attached to the original posts, which are still live. None of these accounts is alleged by this investigation to be innocent or guilty of anything — that is precisely the point. No reader, and no regulator, can tell from the letter.\n\nNote on sourcing — operator-scale losses\n\nOperators canvassed by this investigation report losses on the order of five to ten thousand accounts each in single enforcement waves, with main accounts taken alongside the farm. That canvass is recorded here as first-party reporting, not as a finding. It has no published sample size, no fixed collection date and no per-account verification, and no other number on this page depends on it; the two rows in section 02 that rest on it are marked as such.\n\nIt is stated rather than dropped for two reasons. The chain-ban mechanism above is the documented explanation for exactly that pattern. And a regulator can compel from Valve the one record that would settle it: how many accounts were actioned for automation, in which waves, and how much each of those accounts had spent in the store before it was closed. Until that record exists, the figure stays where it is — reported, attributed and unproven.\n\n07 — The asymmetry\nBoth sides of the same desk\n\nSet that standard of proof against the one Valve applied to its own support operation. The right-hand column is this dossier's own incident register, reproduced with the hedges it carries there.\n\nA customer, for trading\n\nEight documented cases, 2020–2026\n\nConduct\nSelling or buying items on third-party marketplaces; in one case, no conduct at all — the account had been stolen.\nEvidence shown\nNone. \"Based on trading, community reports, and other factors.\"\nNotice\nNone. Valve reserved that in § 4.D: \"Valve is not required to provide you notice before terminating.\"\nAppeal\n\"This lock is permanent and Steam Support cannot help you further with this.\"\nTicket\nClosed on the first reply. Further requests \"may be closed without a reply.\"\nReach\nProfile, friends list, chat, Market, inventory, and every item bought with real money.\nDuration\nPermanent.\nAn automated bot fleet, for volume\n\n694,673 complete sets in public stock across 91 bots\n\nConduct\nRunning automated headless scripts across thousands of accounts simultaneously to idle cards, mass-craft badges and trade sets at industrial scale.\nEvidence shown\nOpenly published bot directories (steam.supply, SteamLvlUp) and public groups with millions of members.\nNotice\nZero intervention. 88.97% carry no ban of any kind; 99.8% of remaining bans are cosmetic.\nAppeal\nNot needed. Fleets operate continuously across multi-year lifecycles without disruption.\nTicket\n—\nReach\nUnrestricted inventory exchange, badge leveling and market liquidity.\nBenefit to Valve\n$26.8M+ in minimum store spend ($5.00 entry gate per account) plus 15% Community Market transaction cuts.\nThe question this leaves, put plainly\n\nAn individual customer who manually trades cards or items faces a permanent, unappealable ban under § 4.C (automation) or § 2.G (commercial use). An automated farming fleet running headless bots across thousands of accounts operates openly with an 88.97% untouched rate. Valve is the beneficiary of both.\n\nThe asymmetry is economic: individual traders take value out of the platform, while automated card fleets pump millions into Valve's store spend gate ($5.00 per account) and fuel transaction fees on every resale. Enforcement does not follow the written rulebook; it follows the revenue model.\n\n08 — Governance\nWho moderates the card economy\n\nThis dossier's recurring finding — that the third-party layer around Steam is staffed from inside Steam — holds in the card economy too, and it ends somewhere specific: nobody independent can count what Valve's enforcement actually does, because the party able to count sits inside that layer. Every fact below was read from Valve's own public group and profile pages on 2026-09-22 and can be reproduced by anyone in a browser.\n\nA Valve employee moderates the largest card-trading group Valve employee\n\nCardTrades ↗ describes itself in its own header as the \"Steam Card Exchange official group\" and carries 97,114 members. Its listed moderators — the accounts that hold the controls of that group — are Mickmane, SgtFopper and afarnsworth ↗.\n\nThat last profile is flagged by Valve's own site markup as a Valve employee — the page carries class=\"profile_header_valve_employee\" — gives its location as Bellevue, Washington, and belongs to the Valve, Steam and Steam Trading Cards Group groups. SteamID64 76561197960434622, member since 12 September 2003.\n\nThe observation is structural, not personal, and it is not an automation point — a moderator of a card-trading group is not running a bot, and nothing here suggests otherwise. The point is the clause in section 07. Steam Card Exchange is a third-party commercial card service; trading cards through third-party services is the exact conduct for which Valve permanently locks ordinary accounts under \"used for commercial purposes based on trading, community reports, and other factors.\" A Valve employee holds a listed moderator role in that service's official community group of ninety-seven thousand people.\n\nNo allegation of wrongdoing is made against any individual here, and no inference is drawn about what that role involves. The asymmetry is the finding: when an ordinary account touches a third-party card or skin service, the answer is a closed ticket and a permanent lock with no evidence shown; when the service is this one, a Valve employee is on the moderator list and the arrangement is visible on a page Valve itself publishes. What is asked is what is asked everywhere else in this dossier: produce the written authorisation, if one exists — and if none is needed, say so in writing, because eight people in section 06 were told the opposite.\n\nThe ban-list layer, and who administers it Volunteer moderatorThird-party service\n\nSteambans.com's group (archived) ↗ (live ↗ archived 2025-12-03 ↗) records its lineage in its preserved group description: \"The official Steambans.com Steam Community Group. SteamBans.com is a brand new service based on an old concept. Global ban lists have been active for years on the old WONID program from VALVe. When the change came to STEAMID it fell natural for us to develop a service specially minded to this new system. But we also wanted more. *. Archive page for Steambans which shut down in 2013.\" Its listed administrators include devicenull and killahinstinct_ ↗.\n\nThat administrator account is not a Valve employee — it carries no employee flag. It is a volunteer with unusually deep standing: a member of Community Moderators (414 members, described as a group \"created by Steam's Community Moderators\"), of Wiki Coordinators, of Steam Community Market, and of Valve programme and pre-release groups including Valve Pipeline, Steam Client Beta, Mobile Auth Beta, New Steam Community Beta, Steam Labs, Steamworks and Report ScamURLs. SteamID64 76561197960794555.\n\nAlso inside that circle and displaying Steambans directly in his public group roster: msart ↗ (groups roster ↗), SteamID64 76561197977933359, whose profile states in its own words \"I run steamid.uk and many other steam and non steam related sites\", and who operates a linked network of sixteen groups — SteamIDcouk (primary group \"Sid website\"), SidAdmins, SidBans, steamideu, Steam3ID, s-id and SArchive among them.\n\nsteamid.uk names the same number itself. Its FAQ: \"Who created SteamID? The SteamID website, network infrastructure, and security systems are all managed by 76561197977933359.\" Two answers further down it states where the data comes from: \"SteamID primarily utilizes the Steam Web API for data collection.\" The same page describes multiple dedicated servers across different hosts, off-site development, storage and text-search servers, and a separate backup facility.\n\nVerified through preserved Internet Archive records: the Steambans group snapshot of 3 Dec 2025 ↗, the operator profile snapshot of 14 Sep 2024 ↗, and the steamid.uk FAQ snapshot of 1 Apr 2026 ↗, matching data read directly on 2026-09-22.\n\nWhat this adds up to, and what it does not\n\nBan lists, SteamID resolution and card trading are the three services that decide who is trusted, who is identifiable, and what an item is worth. None of the three is operated by Valve. On each one, the people holding the controls came from inside Valve's orbit: a flagged Valve employee on the moderator list of the card service's official group; a long-serving Valve community moderator with pre-release programme access administering the ban-list group; the ID-resolution service run by one private individual who sits in the same circle. Three services, three control surfaces, three people Valve had already given standing to.\n\nGroup membership is not employment, and none of this is an accusation. It is a governance fact, and it is the reason the ordinary defence — those are third parties, we cannot control them — has to be tested rather than accepted. The people at the controls are not strangers to Valve. Valve is in a position to say what, if anything, it asked of them; nobody outside is in a position to find out.\n\nNobody counts. That is the finding.\n\nThe Steam ID space is a contiguous integer range. Walking it and reporting how many accounts are banned, how many are limited, and how much inventory sits behind a trade ban is not a research programme — it is a loop and an API key. Valve hands out that key itself, at steamcommunity.com/dev/apikey. And yet no independent party publishes that census. Not a regulator, not a journalist, not an academic, not a consumer body. The only public numbers about the scale of enforcement on Steam are the ones Valve chooses to mention.\n\nThe capability is not missing. It is held. The service that resolves and indexes the ID space at scale — steamid.uk — says in its own FAQ that it \"primarily utilizes the Steam Web API for data collection\" and runs it across multiple dedicated servers, off-site storage and text-search machines and a separate backup facility. It is operated by one private individual. His ban-list sibling group is co-administered by a long-serving Valve community moderator with access to Valve's pre-release programmes. The one party positioned to publish the count sits inside Valve's orbit, and does not publish it.\n\nThis is the same shape the dossier finds everywhere else. Every service that decides something load-bearing about the Steam economy — who is trusted, who is identifiable, what an item is worth, who is banned — is nominally third-party and practically adjacent to Valve. Steam Card Exchange is not an exception to that pattern; it is another instance of it. The defence that these are independent operators is available to Valve precisely because no one has ever been able to test it against a number.\n\nThe 10.88M Account Census: 88.97% Untouched\n\nThe ArchiSteamFarm install base was audited across Valve's GetPlayerBans endpoint (10,880,610 accounts, 55 minutes). The non-limited subset alone represents $26.8M+ in minimum store spend ($5.00 entry threshold). 9,680,599 accounts (88.97%) carry no ban of any kind, and 99.8% of the remainder carry only cosmetic community bans that leave automated trading active.\n\n5,360,499Non-limited ASF members (Steam's displayed count)\n10,880,610Total API entries scanned (limited + non-limited)\n9,680,599Never banned at all (88.97%)\n1,200,011Carry any Steam ban (11.0%) — 99.8% cosmetic\n55 minTo census the whole population, one key\nForensic Evidence & Deep Census\n\nThe detailed demographic breakdown — including ban-type distribution charts, account age at enforcement, creation-year clusters (2020–2026), and geographic self-reporting — is published in the dedicated census investigation.\n\nOpen the Full 10.88M Ban Census (Exhibit VI) →Section 4 — The Asset ID Blackout →\n\nSo the question to put, and it is answerable only by Valve: which identifier or capability was withdrawn, on what date, on whose decision, and what measurable effect did it have on the operators it was aimed at — set against its effect on everyone outside who was trying to count. A change that ends independent auditing does not become neutral because it was announced as a safety measure. It is the reason the census in the block above does not exist.\n\n09 — Method and limits\nWhat was read, and what is not claimed\n\nEvery quotation on this page was taken from the live source on 2026-09-22 and reproduced verbatim. Nothing here is drawn from a scrape, a marketplace credential or a private dataset.\n\nThe four datasets, and the arithmetic on them\n\nEach is a single public request, reproducible from a terminal. No account was used, no marketplace was logged into, and no endpoint requiring a credential was called.\n\nDataset\tWhere it came from\tWhat was computed from it\nCard census\n13,876 games\tSteam Card Exchange's published badge pricelist, the same feed that renders their public price page ↗ archived 2026-08-04 ↗\tGames issuing cards, cards per set, distinct card types, and the market price of each finished set. Medians and the $23,586.57 total are this investigation's arithmetic.\nGame prices\n13,713 resolved\tValve's own public store endpoint, store.steampowered.com/api/appdetails, cc=us, price field only, in batches\tMedian and distribution of the list price of a card-bearing game; the count of games whose finished set outsells the game itself.\nBot stock\n91 bots, 694,673 sets\tThe public card-bot directory at steam.supply/CardBots ↗, read as rendered, no login\tTotal sets in stock, the minimum card count, the drop-allowance floor, and the per-bot pigeonhole floor on distinct accounts.\nCross-check\n21 shared bots\tsteamlvlup.net/cardbots ↗ archived 2026-02-10 ↗, an independent directory of the same bots\tVerification only. On the 21 bots both list, aggregate stock agrees to 0.03%; the largest single-bot disagreement is 1.36%, consistent with two crawls of live inventory minutes apart.\n\nAttribution, as the second directory requires: data provided by SteamLvlUp, licensed under CC BY 4.0 archived 2026-09-23 ↗; used here only as an independent check on a third party's stock figures, and modified in that the per-bot rows were aggregated and compared rather than reproduced. Steam Card Exchange and steam.supply are credited above by link. Game prices are Valve's own. Card, game, and set names and images are Valve's or the publishers', reproduced under neither claim nor licence, as facts about a market.\n\nTwo intended measurements were not made and are not substituted for. Steam's own Community Market endpoints — priceoverview, search/render, pricehistory — return nothing to the collecting host, and Steam Community discussion pages return HTTP 403 to it, so no figure on this page is derived from live Market data. The sale-volume method that would have counted card drops at the daily reset requires a logged-in Steam session; this investigation's manifest states that no marketplace credential was used, and that statement was kept. The bot-stock floor is what can be measured without one.\n\nPrimary sources\n\nSteam Subscriber Agreement ↗ archived 2026-09-24 ↗ — § 2.A, § 2.G, § 3.D, § 4.C, § 4.D.\nSteam Support — Limited User Accounts ↗ — the $5.00 threshold and the restricted-feature list.\nValve — Steam Trading Cards FAQ ↗ — drop mechanics and the $9 free-to-play rate.\nArchiSteamFarm FAQ ↗ and discussion #3440 ↗.\nSteam Community group and profile pages, read directly, for section 08.\nsteamid.uk FAQ, Internet Archive snapshot 2026-04-01 ↗.\nEight Steam Support lock notices published by their recipients, 2020–2026, listed with their links in section 06.\n\nWhat is not claimed\n\nNo revenue figure is estimated for Valve from card farming. No active-account count is asserted for any tool, and the 1.39 million drop allowances are not a count of farm-owned accounts — see the note in section 02. No individual is accused of wrongdoing; where a person is named it is by their own public Steam handle, in their own public role, from a page Valve publishes. None of the eight locked accounts in section 06 is asserted to be innocent or guilty; the finding concerns the letter, not the account. The operator-loss figures in section 02 are first-party reporting and are labelled as such at the sourcing note. The steamid.uk FAQ is quoted from an Internet Archive snapshot because the live page is behind a bot challenge. No claim is made that any ban census has been attempted and suppressed — the finding is only that none is published. The Steam Level curve above 667 is not modelled.\n\nWhy the tool is not the subject\n\nArchiSteamFarm states that it \"is not authorized by Valve\" and it is not accused of anything on this page. It is used as a measuring instrument, because it is the only party in this economy that documents the mechanics in public and in writing. Valve can retire the whole exhibit in one paragraph: publish which commercial automation it authorises, and the per-operator record of what it did about the rest.\n\nRead next: how the Market itself is priced → · the price ladder and the listing cap → · the items Steam will not carry →",
        "headings": [
          {
            "level": 1,
            "id": null,
            "text": "The Card Economy — Wholesaling, Drop Limits & Automated Farming"
          },
          {
            "level": 2,
            "id": null,
            "text": "What a farm actually is, step by step"
          },
          {
            "level": 3,
            "id": null,
            "text": "Buy in"
          },
          {
            "level": 3,
            "id": null,
            "text": "Buy games"
          },
          {
            "level": 3,
            "id": null,
            "text": "Idle\nThe tool logs the account into the Steam network headlessly, \"parses your badges\", builds the list of farmable titles and starts \"playing eligible game and periodically checking if game is fully farmed already.\" Its maintainer's description of the mechanism: it \"does not do anything else than telling Steam we're playing given game.\""
          },
          {
            "level": 3,
            "id": null,
            "text": "Drops run out\nEach title is finite. \"Every game has fixed number of card drops. Once you drop all of them (around a half of the full set), the game is not a candidate for farming anymore.\" A farm that wants to keep producing has to keep buying titles. Card supply is throttled by purchases — by design, and in Valve's favour."
          },
          {
            "level": 3,
            "id": null,
            "text": "Cash out\nThe card leaves by one of three doors: sold on the Community Market, traded away, or crushed into gems. Each is a Subscription Marketplace transaction or a trade, and § 3.D reserves the charge: \"Valve may charge a fee for transactions in a Subscription Marketplace.\" This is the step that makes the whole thing a breach — see 05."
          },
          {
            "level": 2,
            "id": null,
            "text": "Before a farm earns a cent, it has already paid Valve"
          },
          {
            "level": 3,
            "id": null,
            "text": "How large the thing being bought actually is"
          },
          {
            "level": 3,
            "id": null,
            "text": "How big a set is"
          },
          {
            "level": 3,
            "id": null,
            "text": "What the licence costs"
          },
          {
            "level": 3,
            "id": null,
            "text": "What the finished set returns"
          },
          {
            "level": 3,
            "id": null,
            "text": "Where the 694,673 sets are sitting"
          },
          {
            "level": 3,
            "id": null,
            "text": "What this floor does and does not say"
          },
          {
            "level": 3,
            "id": null,
            "text": "And farming does not pay for itself at Valve's prices"
          },
          {
            "level": 3,
            "id": null,
            "text": "What the farm actually props up"
          },
          {
            "level": 4,
            "id": null,
            "text": "Game sales"
          },
          {
            "level": 4,
            "id": null,
            "text": "\"Online\" & playtime"
          },
          {
            "level": 4,
            "id": null,
            "text": "Registrations"
          },
          {
            "level": 4,
            "id": null,
            "text": "Wallet money & fees"
          },
          {
            "level": 4,
            "id": null,
            "text": "Steam-level PR"
          },
          {
            "level": 3,
            "id": null,
            "text": "And the cash-out itself is a value sink Valve taxes twice"
          },
          {
            "level": 3,
            "id": null,
            "text": "This is not a moment. It is an industry with a multi-year backbone."
          },
          {
            "level": 3,
            "id": null,
            "text": "Complete card sets held in the public bot directory, by Steam sale"
          },
          {
            "level": 3,
            "id": null,
            "text": "What one sale's badge ladder looks like from the top"
          },
          {
            "level": 3,
            "id": null,
            "text": "And the same fleet is there when no sale is running"
          },
          {
            "level": 3,
            "id": null,
            "text": "The resting directory, bot by bot"
          },
          {
            "level": 2,
            "id": null,
            "text": "The other product is the number next to your name"
          },
          {
            "level": 3,
            "id": null,
            "text": "Complete sets consumed, level 1 to 1,000"
          },
          {
            "level": 3,
            "id": null,
            "text": "How the curve was checked, because Valve does not publish it"
          },
          {
            "level": 2,
            "id": null,
            "text": "The clause does not describe farming vaguely. It lists it."
          },
          {
            "level": 3,
            "id": null,
            "text": "\"…playtime\""
          },
          {
            "level": 3,
            "id": null,
            "text": "\"…without genuine user input\""
          },
          {
            "level": 2,
            "id": null,
            "text": "Every exit from a farmed card is an exit the licence forbids — and Valve charges a fee at the door"
          },
          {
            "level": 3,
            "id": null,
            "text": "§ 2.A — the licence"
          },
          {
            "level": 3,
            "id": null,
            "text": "§ 2.G — the restriction"
          },
          {
            "level": 3,
            "id": null,
            "text": "§ 3.D — the fee"
          },
          {
            "level": 3,
            "id": null,
            "text": "Read the three together and the position closes"
          },
          {
            "level": 3,
            "id": "fee-ladder",
            "text": "The fee at that door is not 15%. On a farmed card it reaches two-thirds."
          },
          {
            "level": 3,
            "id": null,
            "text": "Effective fee on a Community Market sale, by the seller's asking price"
          },
          {
            "level": 2,
            "id": null,
            "text": "No notice, in waves, and it travels down the phone number"
          },
          {
            "level": 3,
            "id": null,
            "text": "Case 4 — June 2025, VAC bans on idled CS2"
          },
          {
            "level": 3,
            "id": null,
            "text": "How a main account dies"
          },
          {
            "level": 3,
            "id": null,
            "text": "The same paragraph, five years apart, from three different agents"
          },
          {
            "level": 3,
            "id": null,
            "text": "Note on sourcing — operator-scale losses"
          },
          {
            "level": 2,
            "id": null,
            "text": "Both sides of the same desk"
          },
          {
            "level": 3,
            "id": null,
            "text": "A customer, for trading"
          },
          {
            "level": 3,
            "id": null,
            "text": "An automated bot fleet, for volume"
          },
          {
            "level": 3,
            "id": null,
            "text": "The question this leaves, put plainly"
          },
          {
            "level": 2,
            "id": null,
            "text": "Who moderates the card economy"
          },
          {
            "level": 3,
            "id": null,
            "text": "A Valve employee moderates the largest card-trading group Valve employee"
          },
          {
            "level": 3,
            "id": null,
            "text": "The ban-list layer, and who administers it Volunteer moderator Third-party service"
          },
          {
            "level": 3,
            "id": null,
            "text": "What this adds up to, and what it does not"
          },
          {
            "level": 3,
            "id": null,
            "text": "Nobody counts. That is the finding."
          },
          {
            "level": 3,
            "id": null,
            "text": "The 10.88M Account Census: 88.97% Untouched"
          },
          {
            "level": 3,
            "id": null,
            "text": "Forensic Evidence & Deep Census"
          },
          {
            "level": 2,
            "id": null,
            "text": "What was read, and what is not claimed"
          },
          {
            "level": 3,
            "id": null,
            "text": "The four datasets, and the arithmetic on them"
          },
          {
            "level": 3,
            "id": null,
            "text": "Primary sources"
          },
          {
            "level": 3,
            "id": null,
            "text": "What is not claimed"
          },
          {
            "level": 3,
            "id": null,
            "text": "Why the tool is not the subject"
          }
        ],
        "links": [
          "https://phishdestroy.io/steam_dossier/#briefing-heading",
          "https://help.steampowered.com/en/faqs/view/71D3-35C2-AD96-AA3A",
          "https://github.com/JustArchiNET/ArchiSteamFarm/wiki/FAQ",
          "https://steamcommunity.com/tradingcards/faq/",
          "https://store.steampowered.com/subscriber_agreement/",
          "http://web.archive.org/web/20260924114457/https://store.steampowered.com/subscriber_agreement/",
          "https://steamladder.com/ladder/badges/2861690/",
          "http://web.archive.org/web/20260716205303/https://steamladder.com/ladder/badges/2861690/",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/farm-economy-timeline.json",
          "https://store.steampowered.com/charts/",
          "http://web.archive.org/web/20260923183013/https://store.steampowered.com/charts/",
          "https://help.steampowered.com/en/faqs/view/61F0-72B7-9A18-C70B",
          "http://web.archive.org/web/20260921022227/https://help.steampowered.com/en/faqs/view/61F0-72B7-9A18-C70B",
          "https://github.com/JustArchiNET/ArchiSteamFarm/discussions/3440",
          "https://x.com/gergelyszabo94/status/1311004678633795585",
          "https://x.com/prcs25/status/1811893857253982720",
          "http://web.archive.org/web/20240715122902/https://x.com/prcs25/status/1811893857253982720",
          "https://reddit.com/r/steamsupport/comments/1fjmgc5/what_to_do_when_your_steam_account_gets_hacked/mkelm2y/",
          "https://www.reddit.com/r/csgomarketforum/comments/r87owv/psa_my_steam_account_just_got_banned/",
          "http://web.archive.org/web/20250327203008/https://www.reddit.com/r/csgomarketforum/comments/r87owv/psa_my_steam_account_just_got_banned/",
          "https://www.reddit.com/r/GlobalOffensiveTrade/comments/r9xql9/d_recently_received_commercial_ban_for_what_seems/",
          "http://web.archive.org/web/20211206034804/https://www.reddit.com/r/GlobalOffensiveTrade/comments/r9xql9/d_recently_received_commercial_ban_for_what_seems/",
          "https://www.reddit.com/r/csgomarketforum/comments/1hhxx7m/d_permanently_locked_on_steam_for_commercial_use/",
          "http://web.archive.org/web/20250627014045/https://www.reddit.com/r/csgomarketforum/comments/1hhxx7m/d_permanently_locked_on_steam_for_commercial_use/",
          "https://www.reddit.com/r/steamsupport/comments/1hkctwt/permanent_ban_with_no_explanation/",
          "https://www.reddit.com/r/pcgaming/comments/1vf24lu/warning_to_all_gamersexpats_steam_took_my_money/",
          "https://steamcommunity.com/groups/card-trading-card-trades",
          "https://steamcommunity.com/id/afarnsworth",
          "http://web.archive.org/web/20251203104928/https://steamcommunity.com/groups/steambans",
          "https://steamcommunity.com/groups/steambans",
          "http://web.archive.org/web/20251203104928/https://steamcommunity.com/id/killahinstinct_",
          "https://web.archive.org/web/20240914124859/https://steamcommunity.com/id/msart",
          "https://steamcommunity.com/id/msart/groups/",
          "http://web.archive.org/web/20260401154714/https://steamid.uk/faq/",
          "https://phishdestroy.io/steam_dossier/enforcement_audit.html",
          "https://phishdestroy.io/steam_dossier/#evidence-blackout",
          "https://www.steamcardexchange.net/index.php?badgeprices",
          "http://web.archive.org/web/20260804200309/https://www.steamcardexchange.net/index.php?badgeprices",
          "https://steam.supply/CardBots",
          "https://steamlvlup.net/cardbots",
          "http://web.archive.org/web/20260210171205/https://steamlvlup.net/cardbots",
          "https://steamlvlup.net/",
          "https://creativecommons.org/licenses/by/4.0/",
          "http://web.archive.org/web/20260923221628/https://creativecommons.org/licenses/by/4.0/",
          "https://phishdestroy.io/steam_dossier/market_economics.html",
          "https://phishdestroy.io/steam_dossier/skin_atlas.html",
          "https://phishdestroy.io/steam_dossier/elite_skins.html"
        ]
      },
      "source_json": "card_economy.content.json",
      "source_json_sha256": "4487a490a0d307dc5d587ddc13abd4c7654cf798fa7ab6ada0fbd3184f87d7e7"
    },
    {
      "source": "https://phishdestroy.io/steam_dossier/elite_skins",
      "language": "en",
      "title": "One item, two price systems — The Steam Dossier",
      "start_page": 141,
      "end_page": 147,
      "editorial_scope": {
        "policy": "Research prose, conclusions, methodological limits and analytical tables retained without paragraph truncation. Named catalogues and visual galleries are linked; raster images are not embedded.",
        "linked_sections": [
          {
            "id": "register",
            "source": "https://phishdestroy.io/steam_dossier/elite_skins#register"
          },
          {
            "id": "",
            "source": "https://phishdestroy.io/steam_dossier/elite_skins#selected"
          }
        ],
        "raster_images_replaced": 0
      },
      "content": {
        "text": "Dieses Material ist auf Englisch verfügbar.Zurück zum Dossier · Deutsch ↗\nEXHIBIT IV / MARKET ARCHITECTURE / 20 SEPTEMBER 2026\nElite Skins Register — The $1,800 Market Ceiling\n\nOne item. Two price systems.\n\nWHAT THIS SECTION PROVES\n\nThis register establishes an empirical census of all CS2 skin categories priced above Steam's $1,800 Community Market listing cap across five external exchanges. It proves that 248 corroborated high-tier categories—representing 18,394 active listings and $78.6 million in posted liquidity—are 100% absent from Valve's official marketplace. Sellers seeking true market prices are structurally forced onto external platforms while relying exclusively on Steam's underlying trade mechanics.\n\nWhat this means — the Community Market listing ceiling\n\nSteam’s own market refuses a listing above roughly $1,800. A seller may ask less, never more. Items whose market price sits above that line therefore cannot be sold at that price on Steam at all — which is the mechanism that moves those sales to third-party venues while the item itself never leaves Valve’s inventory system.\n\nSection 13 — the off-Steam price gap →\n\n← Back to Executive briefing\n\nSteam caps a Community Market listing at about $1,800. Across the five third-party marketplaces priced in this snapshot, 419 CS2 item categories carry a cheapest live ask above that limit — and 402 of them, 95.9%, have no Steam listing at all. Together they hold 18,641 listed copies worth at least $82.4 million. Requiring a second marketplace to agree before a price counts, 248 of those categories are corroborated — and every single one of them, 100%, is absent from Steam. The dearest is a Sticker | Titan (Holo) | Katowice 2014 at $66,285, quoted by four marketplaces within 5.2% of each other and carried by none of Valve's. The full ladder, the renders and the grading are in the price-ladder atlas.\n\nInspect all 419 entries ↓Open the atlas ↗Read the method\n248categories two or more marketplaces price above the cap\n18,394copies listed across five marketplaces\n$78.6Mfloor value of those listings\n100%of them absent from Steam entirely\n\nCorrection · this page previously led with an uncorroborated price\n\nAn earlier version of this page headlined a Souvenir AK-47 | Point Disarray asked at $148,954 on one marketplace while Steam priced it at $119. That row rests on a single shelf and a single copy with no second marketplace agreeing, so it is an asking price rather than a price, and it no longer carries the page. Every headline figure here is now restricted to the 248 categories that at least two marketplaces independently price above the cap. The row itself has not been removed — it is still in the register below, and the grading that demoted it is set out in full in the price-ladder atlas.\n\n01 / the money in active asks\nThe measurable dollar floor\n\nRecomputed from the licensed cs2.sh snapshot across five marketplaces. This is a minimum aggregate asking value in a defined subset, not sales turnover and not a valuation of the CS2 economy.\n\n248 CORROBORATED CATEGORIES · 18,394 LISTED COPIES · 5 MARKETPLACES$78.62M\n\nMinimum aggregate posted ask of every CS2 item that two or more marketplaces independently price above the limit Valve permits on its own market.\n\nWhy this is a floor, not an estimate\n\nFor each marketplace we multiply its lowest ask for an item by the number of copies that marketplace lists. Every other copy on that shelf is priced at or above the lowest ask, so the true posted value is higher — by construction, not by guesswork. It is not a sale, a cash flow or a market-wide valuation, and the same physical item may appear on more than one marketplace.\n\nCheck all 419 source rows ↗\n★ Sport Gloves | Hedge Maze (Field-Tested)\n$4.68M\nAWP | Gungnir (Factory New)\n$4.46M\nAWP | Dragon Lore (Factory New)\n$4.34M\n★ Butterfly Knife | Fade (Factory New)\n$4.17M\nAK-47 | Wild Lotus (Factory New)\n$4.16M\n★ Butterfly Knife | Doppler (Factory New)\n$3.64M\n\nBars show the six largest category-level contributions to the floor calculation, scaled against the largest. A high bar reflects both the cheapest ask and the number of copies listed. The same physical item can appear on more than one marketplace, so these figures must not be added to any other market total.\n\n02 / inspectable examples\nWhat the limit leaves out\n\nIllustrations correspond to exact item names where available. Prices are active asking prices from the dated catalogue, not transaction records.\n\n★ Butterfly Knife | Doppler (Factory New)\n\nSource: https://phishdestroy.io/steam_dossier/elite_skins#selected\n\nThe measurable gap: these offers cannot be matched by a Steam listing at the same USD figure. Valve’s own Community Market FAQ archived 2026-09-21 ↗ states an approximately $1,800 maximum listing price. A seller could still list below it; whether that would be acceptable is the seller’s choice. A separate CSMarketCap search for items above $1,800 ↗ shows Factory New Dragon Lore across 28 indexed markets with about 1.1K displayed offers; mirrored inventory can be counted more than once.\n\n03 / the structural dependency\nSteam's cap sends price discovery outside Steam\n\nThe comparison is structural. It neither assumes every asking price is fair nor treats unsold listings as revenue.\n\n01 · THE RULE\nSteam caps the listing\n\nValve says Community Market listings are capped at approximately $1,800. Wallet balances are also capped, and wallet funds cannot be withdrawn as cash.\n\n02 · THE OBSERVATION\nDragon Lore: $10,940.85\n\nThe 5-marketplace catalogue shows 389 live offers for AWP Dragon Lore (Factory New), starting at $10,940.85 (CSFloat floor). The wider register contains 248 corroborated categories above Steam's limit.\n\n03 · THE CONSEQUENCE\nPrice and transfer split\n\nA seller seeking that higher price cannot post it on Steam. External services can set the cash price, but delivery still uses Steam-controlled item ownership and transfer.\n\nThe policy contradiction: Valve's own Subscriber Agreement archived 2026-09-21 ↗ reserves commercial exploitation of Steam services unless expressly permitted, while its 2016 statement archived 2026-09-21 ↗ said gambling operators were already using Steam OpenID and automated accounts. That is direct evidence Valve knew of this class of outside operator in 2016. Yet the official marketplace cannot post the observed prices of these high-value items. That is architectural dependence on off-Steam price discovery and transactions; the contract status of each individual marketplace requires separate evidence. The two primary Western marketplaces capturing this over-cap transaction volume operate as formal corporate entities in major jurisdictions — CSFloat Inc. (incorporated in Delaware, USA) and Skinport GmbH (registered in Stuttgart, Germany, HRB 764879) — openly transacting hundreds of millions in peer-to-peer item sales relying directly on Steam Web APIs and trade infrastructure.\n\nWhat this means — OpenID and openid.realm\n\nOpenID is the sign-in standard behind the “Sign in with Steam” button: the site does not receive the password, Steam confirms the identity to it. openid.realm is the field carrying the address of the site asking for the sign-in, and openid.return_to the address Steam is to send the user back to. Steam receives both on every request and prints the realm on its own login page — which is why this dossier can name the host each platform authenticates through.\n\nSection 3 — the observed routes →\n\nThe four $100,000 rows sit at CSFloat’s own maximum listing price. They are marked in the register and must not be read as appraisals. The archived CSFloat listing crawl only reached approximately $6,999, so the public catalogue snapshot is used for the full >$1,800 register.\n\n04 / another Valve game\nThe ceiling also catches Dota 2\n\nThe same strict cheapest-offer test on Skinport finds 166 CS2 categories and 3 Dota 2 categories. They are a separate marketplace snapshot; do not add them to CSFloat’s 245.\n\nDOTA 2 · 1 OFFER\nHeroic Brutal Crescent\n\nCheapest Skinport ask: $14,622.25.\n\nDOTA 2 · 1 OFFER\nDark Artistry Cape\n\nCheapest Skinport ask: $8,255.16.\n\nDOTA 2 · 1 OFFER\nCorrupted Powered Star\n\nCheapest Skinport ask: $2,087.92.\n\nThese are three listed item categories, not every Dota 2 item in existence. Inspect the dated Skinport rows ↗ and API documentation ↗.\n\n05 / robustness\nThe finding does not depend on the exact cap\n\nValve sets the cap in the buyer's regional currency, so converted to USD it does not land on one clean figure. The census is therefore repeated at every plausible threshold. The share of these items missing from Steam never moves below 95%.\n\nThreshold tested\tItem categories\tCopies listed\tFloor value\tAbsent from Steam\n$1,800\t419\t18,641\t$82,449,526\t95.9%\n$2,000\t382\t15,159\t$75,541,325\t95.5%\n$2,070\t363\t12,336\t$69,560,305\t95.6%\n$2,300\t323\t11,644\t$67,984,432\t95.0%\n$2,500\t299\t10,950\t$66,203,929\t95.0%\n\nRead one row at a time; the rows are nested subsets of the same census, not separate populations. “Floor value” multiplies each marketplace's lowest ask by the number of copies it lists, so it understates the shelf by construction. Open the dataset ↗\n\n06 / scarcity you can count\nHow few of these actually exist for sale\n\nBUFF splits each item's shelf into float brackets and publishes how many copies sit in each. That turns “rare” from a word into a count — and prices the condition separately from the skin.\n\n298 COPIES LISTED\nAWP | Dragon Lore\n\n8 distinct variants priced. The dearest, Souvenir AWP | Dragon Lore (Factory New), asks $12,363 with 20 copies on the shelf.\n\nIn the best float bracket on the shelf (0–0.01) there are 2 copies, asking $17,875 — a +45% premium over the item's base ask for condition alone.\n\n607 COPIES LISTED\nM4A4 | Howl\n\n12 distinct variants priced. The dearest, Souvenir M4A4 | Howl (Factory New), asks $14,895 with 2 copies on the shelf.\n\n213 COPIES LISTED\nAK-47 | Wild Lotus\n\n7 distinct variants priced. The dearest, Souvenir AK-47 | Wild Lotus (Factory New), asks $14,895 with 2 copies on the shelf.\n\n310 COPIES LISTED\nAWP | Gungnir\n\n7 distinct variants priced. The dearest, Souvenir AWP | Gungnir (Minimal Wear), asks $14,895 with 2 copies on the shelf.\n\nWhy this matters to the rest of this dossier: these are not abstractions. A few hundred copies of each trophy exist on the open shelf worldwide, each tied to one Steam account and moved by one Steam trade. A market this thin is one where a single stolen inventory is a measurable event, and where the account-takeover techniques documented elsewhere in this investigation have a direct and quantifiable payoff.\n\nCounts are live listings on one marketplace at capture time, not the total number in existence. Copies held in private inventories are not counted anywhere here. Open the float dataset ↗\n\n07 / the ladder out of sight\nThe dearer the item, the further from any observable venue\n\nEach rung below is a different evidentiary class. They are deliberately not merged into one number.\n\nRung\tFigure\tWhat kind of fact this is\nCeiling on Valve's own market\t~$1,800\tPublished rule, stated in the Steam Community Market FAQ.\nDearest ask several marketplaces agree on\t$66,285\tMeasured by us in this snapshot. Sticker | Titan (Holo) | Katowice 2014, quoted by four marketplaces within 5.2% of one another. An ask, not a sale.\nDearest ask seen on any single shelf\t$148,954\tOne marketplace, one copy, no second marketplace agreeing — and equal to a round CNY 1,000,000 at the snapshot rate. Listed here as the outer edge of what sellers ask, and relied on for nothing.\nPublic marketplace sale\t$49,999\tSpecialist Gloves | Crimson Kimono (FN) on CSFloat, as reported by SteamAnalyst. Platform-recorded, third-party reported.\nReported private sale\t$400,000\tAK-47 | Case Hardened, reported by PC Gamer in April 2023. Journalism, not a record we hold.\nReported offer, declined\t$1,500,000\tBlue Gem Karambit, pattern #387. No sale took place and the figure has not been independently confirmed. Included to mark the ceiling of the claims, not to assert a value.\n\nThe structural point: Valve's market stops at about $1,800. Third-party marketplaces carry the trade to around $66,000 where several of them agree, and to roughly $150,000 where only one does. Above that there is no venue at all — the largest transfers of Valve-issued property happen privately, between individuals, with no listing, no platform record, no identity check and no reporting. The transfer itself still runs on Steam. The higher the value, the less anyone can see it, and the infrastructure carrying it is Valve's throughout.\n\nThe last two rungs are other people's reporting, cited as such. This project did not verify them and does not rely on them for any conclusion.\n\nAll 419 observed categories\n\nSource: https://phishdestroy.io/steam_dossier/elite_skins#register\n\n09 / provenance and limits\nCheck the calculation\n\nWe expose the local data and the public source. The numerical headline is scoped to CSFloat on the capture date.\n\nValve’s own ceiling and terms\n\nSteam Community Market FAQ ↗ archived 2026-09-21 ↗ states the approximate $1,800 listing maximum. The Subscriber Agreement ↗ archived 2026-09-21 ↗ sets the commercial-use restrictions.\n\nWhere the prices come from\n\nPrices, listing counts and float brackets are taken from the cs2.sh market data API under a paid commercial subscription, using a licensed key. No marketplace was scraped and no marketplace account or credential was used. The provider aggregates BUFF, Youpin, CSFloat, Skinport, C5Game and the Steam Community Market; all figures are USD as returned. Open the provenance manifest ↗ — it records the exact endpoints, capture times and SHA-256 hashes of the raw snapshots, so an independent reader with their own key can pull the same data and recompute every number on this page.\n\nWhat we could not obtain\n\nThe subscription purchased covers current snapshots only. Historical and archive endpoints were not available to us, and no claim about any trend, any past price or any change over time is made on this page. Everything here is a single moment, dated.\n\nThe earlier CSFloat register\n\nThe first version of this exhibit counted 245 categories from a single CSFloat catalogue snapshot dated 20 September 2026: that snapshot remains here ↗. The present register is wider because it spans five marketplaces rather than one. The two are separate captures and must not be added together.\n\nValve's specific enforcement statement\n\nValve's 2016 in-game item trading update ↗ archived 2026-09-21 ↗ addresses gambling operators using OpenID and automated Steam accounts. It is narrower than a ban on every outside marketplace.\n\nInterpretation boundary\n\nThese are offers, not sales. A market name can cover multiple physical items with different float, pattern or sticker details. This register does not measure total market value or Valve’s intent.",
        "headings": [
          {
            "level": 1,
            "id": null,
            "text": "Elite Skins Register — The $1,800 Market Ceiling"
          },
          {
            "level": 2,
            "id": null,
            "text": "The measurable dollar floor"
          },
          {
            "level": 3,
            "id": null,
            "text": "Why this is a floor, not an estimate"
          },
          {
            "level": 2,
            "id": null,
            "text": "What the limit leaves out"
          },
          {
            "level": 3,
            "id": null,
            "text": "★ Butterfly Knife | Doppler (Factory New)"
          },
          {
            "level": 2,
            "id": null,
            "text": "Steam's cap sends price discovery outside Steam"
          },
          {
            "level": 3,
            "id": null,
            "text": "Steam caps the listing"
          },
          {
            "level": 3,
            "id": null,
            "text": "Dragon Lore: $10,940.85"
          },
          {
            "level": 3,
            "id": null,
            "text": "Price and transfer split"
          },
          {
            "level": 2,
            "id": null,
            "text": "The ceiling also catches Dota 2"
          },
          {
            "level": 3,
            "id": null,
            "text": "Heroic Brutal Crescent"
          },
          {
            "level": 3,
            "id": null,
            "text": "Dark Artistry Cape"
          },
          {
            "level": 3,
            "id": null,
            "text": "Corrupted Powered Star"
          },
          {
            "level": 2,
            "id": null,
            "text": "The finding does not depend on the exact cap"
          },
          {
            "level": 2,
            "id": null,
            "text": "How few of these actually exist for sale"
          },
          {
            "level": 3,
            "id": null,
            "text": "AWP | Dragon Lore"
          },
          {
            "level": 3,
            "id": null,
            "text": "M4A4 | Howl"
          },
          {
            "level": 3,
            "id": null,
            "text": "AK-47 | Wild Lotus"
          },
          {
            "level": 3,
            "id": null,
            "text": "AWP | Gungnir"
          },
          {
            "level": 2,
            "id": null,
            "text": "The dearer the item, the further from any observable venue"
          },
          {
            "level": 2,
            "id": null,
            "text": "All 419 observed categories"
          },
          {
            "level": 2,
            "id": null,
            "text": "Check the calculation"
          },
          {
            "level": 3,
            "id": null,
            "text": "Valve’s own ceiling and terms"
          },
          {
            "level": 3,
            "id": null,
            "text": "Where the prices come from"
          },
          {
            "level": 3,
            "id": null,
            "text": "What we could not obtain"
          },
          {
            "level": 3,
            "id": null,
            "text": "The earlier CSFloat register"
          },
          {
            "level": 3,
            "id": null,
            "text": "Valve's specific enforcement statement"
          },
          {
            "level": 3,
            "id": null,
            "text": "Interpretation boundary"
          }
        ],
        "links": [
          "https://phishdestroy.io/steam_dossier/de/elite_skins.html",
          "https://phishdestroy.io/steam_dossier/de/#market-gap-section",
          "https://phishdestroy.io/steam_dossier/de/#briefing-heading",
          "https://phishdestroy.io/steam_dossier/de/skin_atlas.html",
          "https://phishdestroy.io/steam_dossier/de/skin_atlas.html#grading",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/cs2sh-above-the-ceiling.json",
          "https://phishdestroy.io/steam_dossier/elite_skins#selected",
          "https://help.steampowered.com/en/faqs/view/61F0-72B7-9A18-C70B",
          "http://web.archive.org/web/20260921022227/https://help.steampowered.com/en/faqs/view/61F0-72B7-9A18-C70B",
          "https://csmarketcap.com/search?minPrice=1800&page=1",
          "https://store.steampowered.com/agreement/?l=english",
          "http://web.archive.org/web/20260921022032/https://store.steampowered.com/agreement/?l=english",
          "https://store.steampowered.com/oldnews/22883",
          "http://web.archive.org/web/20260921021947/https://store.steampowered.com/oldnews/22883",
          "https://phishdestroy.io/steam_dossier/de/#proxy-bypass-explainer",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/skinport-floor-over-cap.json",
          "https://docs.skinport.com/items",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/cs2sh-float-scarcity.json",
          "https://phishdestroy.io/steam_dossier/elite_skins#register",
          "https://cs2.sh/",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/cs2sh-manifest.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/csfloat-catalogue.json"
        ]
      },
      "source_json": "elite_skins.content.json",
      "source_json_sha256": "fd689c51eee7fb22ea44f6388710d3458c21a9ee54db197fe9011f9e9ee4a2ba"
    },
    {
      "source": "https://phishdestroy.io/steam_dossier/skin_atlas",
      "language": "en",
      "title": "The atlas of what Steam cannot carry — The Steam Dossier",
      "start_page": 148,
      "end_page": 160,
      "editorial_scope": {
        "policy": "Research prose, conclusions, methodological limits and analytical tables retained without paragraph truncation. Named catalogues and visual galleries are linked; raster images are not embedded.",
        "linked_sections": [
          {
            "id": "gallery",
            "source": "https://phishdestroy.io/steam_dossier/skin_atlas#gallery"
          }
        ],
        "raster_images_replaced": 0
      },
      "content": {
        "text": "Dieses Material ist auf Englisch verfügbar.Zurück zum Dossier · Deutsch ↗\nEXHIBIT IV-B / THE PRICE LADDER / 2026-09-23\nSkin Price-Ladder Atlas — The Liquidity Cliff\n\nValve's market stops where the money starts.\n\nWHAT THIS SECTION PROVES\n\nThis visual atlas analyzes 30,266 item categories across five marketplace catalogues, measuring market coverage above and below Valve's listing threshold. Below the $1,800 cap, Steam hosts 95.3% of active categories; immediately above it, official coverage collapses to 1.9% (with 0.0% coverage across corroborated assets). This demonstrates an abrupt, structural liquidity cliff where Valve delegates high-value transaction discovery to outside platforms while retaining full control over underlying asset custody.\n\n← Back to Executive briefing\n\nEvery CS2 item with a live price on five marketplaces was placed in a price band by its cheapest ask, and each band was measured for one thing: what share of it Valve’s own Community Market still carries. Below Valve’s listing cap the answer is 95.3%. Above it, the answer is 1.9%. The drop is not gradual and it does not fall where demand falls — it falls exactly at the published rule. Of the 248 item categories that two or more marketplaces independently price above the cap, 100.0% have no Steam listing at all.\n\nSee the cliff ↓Open the gallery of 419 itemsMethod and limits\n30,266item categories measured\n95.3%of sub-cap items carried by Steam\n1.9%of above-cap items carried by Steam\n$78.6Mfloor value of the corroborated set\n01 / the measurement\nThe cliff lands on the rule, not on demand\n\nEach of the 30,266 item categories below is placed in a band by its cheapest live ask across BUFF163, CSFloat, Skinport, YouPin 898 and C5Game, and only items quoted on two or more of them are counted, so no single optimistic listing can invent a band member. The upper panel is the share of each band that Valve’s own market still carries.\n\nShare of each price band carried by the Steam Community Market\nupper: steam coverage · lower: items per band, log scale\n0%\n25%\n50%\n75%\n100%\n100%\n96.9%\n95.9%\n97.3%\n91.1%\n76.8%\n14.5%\n2.9%\n1.5%\n0%\n0%\n0%\n4,632\n1¢–10¢\n7,152\n10¢–$1\n8,568\n$1–10\n5,941\n$10–100\n2,329\n$100–300\n1,292\n$300–1k\n193\n$1k–1.8k\n70\n$1.8k–3k\n67\n$3k–10k\n18\n$10k–30k\n3\n$30k–100k\n1\n$100k+\nitems\nlog\nVALVE’S LISTING CAP\nat or below Valve’s listing capabove the cap — Valve’s rule forbids the listingitem categories in the band\n\nCoverage means a live Steam ask existed for that category at the moment of capture. The lower panel is logarithmic because the catalogue is overwhelmingly cheap: reading it linearly would flatten every band above $300 into the baseline.\n\nWhat the shape rules out\n\nIf expensive items were simply unpopular, coverage would sag gradually as price rose. It does not. It holds at 76.8% through the $300–$1k band, then collapses to 14.5% in the band immediately beneath the cap and 2.9% in the band immediately above it. A demand effect does not know where Valve set its ceiling. A rule does.\n\nPrice band\tItem categories\tWith a live Steam ask\tSteam coverage\tCopies listed off Steam\n1¢–10¢\t4,632\t4,632\t100%\t8,223,227\n10¢–$1\t7,152\t6,931\t96.9%\t5,488,315\n$1–10\t8,568\t8,213\t95.9%\t3,939,538\n$10–100\t5,941\t5,780\t97.3%\t1,328,255\n$100–300\t2,329\t2,121\t91.1%\t364,466\n$300–1k\t1,292\t992\t76.8%\t187,504\n$1k–1.8k\t193\t28\t14.5%\t40,281\n$1.8k–3k\t70\t2\t2.9%\t9,592\n$3k–10k\t67\t1\t1.5%\t6,706\n$10k–30k\t18\t0\t0%\t1,366\n$30k–100k\t3\t0\t0%\t21\n$100k+\t1\t0\t0%\t2\n\nPattern and phase variants are excluded from this ladder: Steam does not list a blue-gem tier or a Ruby phase as its own market entry, so counting them would understate Steam’s coverage. Measured without the two-marketplace requirement the same ladder reads 79.1% below the cap and 6.5% above it across 37,204 items — a starker gap, built on weaker evidence, which is why it is not the figure quoted.\n\n02 / evidential grading\nAn asking price is not a price\n\nAnyone can list a P2000 for a round ten million yuan. Before a figure on this page is used for anything, it is graded by how many marketplaces independently quote the item above the cap and how tightly the middle of those quotes clusters. Only grades A and B are quoted — here or anywhere else in this dossier.\n\nA  Three or more shelves agree\n\nThree or more marketplaces quote the item above the cap and their median sits within 25% of the cheapest. 197 categories, 18,218 copies, $76,585,587.\n\nAbsent from Steam: 100.0%.\n\nB  Two shelves agree\n\nTwo marketplaces agree above the cap, or three agree less tightly. 51 categories, 176 copies, $2,038,814.\n\nAbsent from Steam: 100.0%.\n\nC  One shelf — not used\n\nA single marketplace carries the only above-cap ask. 171 categories, 247 copies. Shown in the gallery for completeness and excluded from every total on this page.\n\nThese are requests for a price, not evidence of one.\n\nWhat this correction cost, and what it bought\n\nDropping grade C removes 171 categories and $3,825,125 from the headline. What is left is smaller and much harder to argue with: 248 categories, 18,394 listed copies, $78,624,401, and 100.0% of them — every single one — absent from Valve’s market. The grade-C rows are the reason the figure moved; they are listed, not hidden.\n\nListings set aside as artefacts\n\nAny quote more than three times the cheapest ask on the same item is set aside. Converted at the rate the data itself implies, most of them are round CNY figures — the signature of a placeholder or a platform ceiling rather than an offer. Because every total on this page uses the cheapest ask, none of these figures could ever have inflated a number; they are excluded so that none of them can be quoted as a headline either.\n\nItem\tCheapest live ask\tSet aside\nSouvenir P2000 | Wicked Sick (Minimal Wear)\t$148,954\t$1,489,543\n★ Specialist Gloves | Crimson Kimono (Minimal Wear) | Phase 1\t$37,239\t$119,163\nSouvenir USP-S | Printstream (Factory New)\t$2,000\t$59,582\n★ Bowie Knife | Crimson Web (Factory New)\t$2,957\t$43,030\n★ Karambit | Marble Fade (Factory New) | 1st\t$11,916\t$38,874\nSticker | Ninjas in Pyjamas (Holo) | Katowice 2014\t$5,000\t$31,748\nSouvenir AWP | Dragon Lore (Battle-Scarred)\t$4,225\t$29,157\n★ Karambit | Doppler (Minimal Wear) | Ruby\t$7,122\t$27,273\nAll 419 categories, with the object each price refers to\n\nSource: https://phishdestroy.io/steam_dossier/skin_atlas#gallery\n\n04 / where it went instead\nThe shelves that carry what Steam will not\n\nThe same listings, grouped by the marketplace holding them. This is a count of where copies are listed, which is not the same as where they are owned and is not read here as such.\n\nFloor value of above-cap listings, by marketplace\nlowest ask x copies listed on that shelf\nYouPin 898\n$22,720,252\nBUFF163\n$22,022,606\nC5Game\n$12,560,543\nCSFloat\n$10,871,845\nSkinport\n$1,385,060\n\nJurisdictions, in the order above: YouPin 898 — China · BUFF163 — China · C5Game — China · CSFloat — United States · Skinport — Germany / Malta. The same physical item can be listed on more than one of these shelves, so these figures must not be summed with any other market total.\n\nFloor value by price tier\nhow the money is distributed above the cap\n$1.8k-3k\n$9,842,391\n$3k-10k\n$36,787,269\n$10k-50k\n$20,038,749\nover $50k\n$2,891,897\n05 / scarcity you can count\nHow thin the supply actually is\n\nEach CS2 item carries a wear value, and the marketplaces publish how many copies sit in each band of it. That turns “rare” from an adjective into a number — and it is the number that explains why a single compromised account is worth the effort of a bespoke phishing kit.\n\nAWP | Dragon Lore\n150 listed · from $11,350\n0.00–0.01\n29 · $14,730\n0.01–0.02\n54 · $11,618\n0.02–0.03\n26 · $11,350\n0.03–0.04\n25 · $11,618\n0.04–0.07\n16 · $11,585\n\nAWP | Dragon Lore (Factory New)\n\nM4A4 | Howl\n105 listed · from $6,628\n0.00–0.01\n11 · $10,725\n0.01–0.02\n14 · $8,088\n0.02–0.03\n11 · $7,580\n0.03–0.04\n19 · $6,703\n0.04–0.07\n50 · $6,628\n\nM4A4 | Howl (Factory New)\n\nAK-47 | Wild Lotus\n113 listed · from $14,373\n0.00–0.01\n25 · $22,343\n0.01–0.02\n11 · $19,364\n0.02–0.03\n3 · $19,645\n0.03–0.04\n15 · $15,044\n0.04–0.07\n59 · $14,373\n\nAK-47 | Wild Lotus (Factory New)\n\nAWP | Gungnir\n173 listed · from $11,618\n0.00–0.01\n28 · $17,875\n0.01–0.02\n21 · $13,600\n0.02–0.03\n32 · $12,065\n0.03–0.04\n29 · $11,735\n0.04–0.07\n63 · $11,618\n\nAWP | Gungnir (Factory New)\n\nAK-47 | Fire Serpent\n278 listed · from $663\n0.15–0.18\n87 · $730\n0.18–0.21\n49 · $712\n0.21–0.24\n52 · $703\n0.24–0.27\n18 · $715\n0.27–0.38\n72 · $663\n\nAK-47 | Fire Serpent (Field-Tested)\n\nCase Hardened (all tiers / blue gem)\n76 listed · from $1,638\n0.07–0.08\n1 · $2,516\n0.08–0.09\n4 · $2,482\n0.09–0.10\n6 · $3,856\n0.10–0.11\n7 · $2,797\n0.11–0.15\n58 · $1,638\n\nAK-47 | Case Hardened (Minimal Wear) | Tier 1\n\nBands are the marketplaces’ own float buckets; only bands with at least one live listing are drawn. The price beside each bar is the cheapest live ask in that band, so the premium attached to a low float is directly readable rather than asserted.\n\n06 / movement, measured off Steam\nWhat the third-party shelves actually realised\n\nValve publishes no usable history at this tier, and this dossier claims none. Skinport does publish its own completed sales over the trailing 24 hours, 7, 30 and 90 days, and that is the whole of the time dimension available here: a median realised price per trailing window, indexed so the 90-day median is 100. No Steam data is involved in either chart.\n\nMedian realised price, trailing window\nindexed to the 90-day median · 6,758 items with 20+ sales\n85\n91\n97\n103\n100\n90d\n94\n30d\n90\n7d\n88\n24h\nCompleted sales per day\nsame items, same windows\n7,621\n9,653\n11,684\n13,716\n12,700\n90d\n11,894\n30d\n9,540\n7d\n8,637\n24h\n\nThese are two charts rather than one with two vertical scales: an index and a daily count share no unit, and drawing them on a common axis would invite a comparison that is not valid. The windows are nested and trailing — the 90-day figure contains the 24-hour figure — so this is not a daily series and must not be read as one. What it supports is narrow and stated plainly: over the trailing windows Skinport published, the median realised price sat below its own 90-day median and the daily sale count fell with it.\n\nSkinport realised sales. The windows are nested and trailing, so each point is the median realised price over the trailing window, indexed to the 90-day median. It is not a daily series and no Steam data is involved.\n\n07 / what it is made of\nSixteen-year-old stickers and a handful of gloves\n\nThe set above the cap is not a broad slice of the game. It concentrates in a few rarities and a few collections, several of which can no longer be obtained at all — which is exactly why the supply cannot respond to the price.\n\nCategories above the cap, by rarity\ncount of item categories\nCovert\n321\nClassified\n39\nRestricted\n24\nContraband\n12\nMil-Spec Grade\n9\nConsumer Grade\n9\nIndustrial Grade\n5\nCategories above the cap, by collection\ntop ten collections\nThe St. Marc Collection\n13\nThe Cobblestone Collection\n13\nThe Norse Collection\n12\nThe Arms Deal Collection\n9\nThe Canals Collection\n7\nThe Gods and Monsters Collection\n6\nThe Revolution Collection\n4\nThe 2021 Train Collection\n4\nThe Rising Sun Collection\n4\nThe Chop Shop Collection\n4\n\nBy category: skin 366, sticker 48, container 3, sticker_slab 2.\n\n08 / the most anyone actually paid\nHighs backed by a transaction, not by a listing\n\nEvery other price on this page is an ask — what a seller wants. These are sales: the highest completed transaction Skinport recorded for each item, over the trailing 90 days. It is the only figure in this dossier that somebody actually paid, and each row links to the marketplace so the number can be checked against its source rather than against us.\n\n21,216items with a completed sale in the window\n106sold at or above Valve’s listing cap\n$14,192highest single completed sale\n67/419above-cap categories with any recorded sale\nThe thirty highest completed sales in the window\nItem\tHighest sale\tMedian sale\tSales\tCheapest ask now\tSteam\tCheck it\nAWP | Gungnir (Factory New)\t$14,192\t$11,343\t5\t$11,490\tabsent\tSkinport CSFloat Steam\nStatTrak™ M4A4 | Howl (Factory New)\t$12,387\t$12,387\t1\t$13,836\tabsent\tSkinport CSFloat Steam\nAWP | Dragon Lore (Factory New)\t$11,779\t$11,063\t16\t$10,941\tabsent\tSkinport CSFloat Steam\nAK-47 | Wild Lotus (Minimal Wear)\t$11,693\t$11,693\t1\t$9,946\tabsent\tSkinport CSFloat Steam\nAWP | Gungnir (Minimal Wear)\t$10,437\t$10,437\t1\t$9,610\tabsent\tSkinport CSFloat Steam\nStatTrak™ AK-47 | Blue Laminate (Minimal Wear)\t$9,772\t$37\t76\t$30\t$40\tSkinport CSFloat Steam\nStatTrak™ M4A4 | Howl (Minimal Wear)\t$9,463\t$9,463\t1\t$9,500\tabsent\tSkinport CSFloat Steam\nAWP | Dragon Lore (Minimal Wear)\t$9,104\t$9,026\t6\t$8,524\tabsent\tSkinport CSFloat Steam\n★ Sport Gloves | Hedge Maze (Minimal Wear)\t$8,139\t$8,139\t1\t$6,819\tabsent\tSkinport CSFloat Steam\nAK-47 | Wild Lotus (Field-Tested)\t$7,617\t$7,390\t4\t$7,194\tabsent\tSkinport CSFloat Steam\nStatTrak™ M4A4 | Howl (Field-Tested)\t$7,615\t$7,615\t1\t$7,100\tabsent\tSkinport CSFloat Steam\nAWP | Gungnir (Field-Tested)\t$7,149\t$7,006\t2\t$7,165\tabsent\tSkinport CSFloat Steam\nAWP | Dragon Lore (Field-Tested)\t$6,711\t$6,194\t15\t$5,988\tabsent\tSkinport CSFloat Steam\nM4A4 | Howl (Factory New)\t$6,679\t$6,613\t3\t$6,628\tabsent\tSkinport CSFloat Steam\n★ Sport Gloves | Superconductor (Factory New)\t$6,084\t$6,084\t1\t$7,969\tabsent\tSkinport CSFloat Steam\nAWP | Gungnir (Battle-Scarred)\t$5,750\t$5,413\t3\t$5,899\tabsent\tSkinport CSFloat Steam\n★ Sport Gloves | Pandora's Box (Minimal Wear)\t$5,520\t$5,508\t3\t$4,998\tabsent\tSkinport CSFloat Steam\n★ Sport Gloves | Vice (Factory New)\t$5,385\t$5,158\t2\t$5,700\tabsent\tSkinport CSFloat Steam\nM4A4 | Howl (Minimal Wear)\t$5,342\t$4,989\t19\t$4,997\tabsent\tSkinport CSFloat Steam\n★ Sport Gloves | Hedge Maze (Field-Tested)\t$5,334\t$4,862\t5\t$3,724\tabsent\tSkinport CSFloat Steam\nStatTrak™ AK-47 | Vulcan (Factory New)\t$5,275\t$1,418\t12\t$1,280\tabsent\tSkinport CSFloat Steam\nAK-47 | Wild Lotus (Well-Worn)\t$4,978\t$4,978\t1\t$4,942\tabsent\tSkinport CSFloat Steam\nAWP | Dragon Lore (Well-Worn)\t$4,931\t$4,931\t1\t$5,445\tabsent\tSkinport CSFloat Steam\nAK-47 | Hydroponic (Factory New)\t$4,802\t$4,351\t2\t$3,648\tabsent\tSkinport CSFloat Steam\n★ Talon Knife | Case Hardened (Minimal Wear)\t$4,588\t$466\t16\t$442\t$630\tSkinport CSFloat Steam\nAWP | Medusa (Factory New)\t$4,484\t$4,484\t1\t$4,171\tabsent\tSkinport CSFloat Steam\n★ Specialist Gloves | Pillow Punchers (Factory New)\t$4,359\t$4,359\t1\t$4,302\tabsent\tSkinport CSFloat Steam\n★ Sport Gloves | Pandora's Box (Field-Tested)\t$4,359\t$3,666\t11\t$3,245\tabsent\tSkinport CSFloat Steam\nM4A4 | Howl (Field-Tested)\t$4,289\t$4,225\t8\t$4,022\tabsent\tSkinport CSFloat Steam\nAWP | Dragon Lore (Battle-Scarred)\t$4,124\t$4,124\t1\t$4,279\tabsent\tSkinport CSFloat Steam\nSame item, same 90 days, wildly different price\n\nRestricted to items with a $100 median and at least five completed sales, because on a cheap skin one freak sale swamps the ratio. What is left is dominated by Case Hardened finishes, where the pattern decides the price and the marketplace files every pattern under one name — the same mechanism measured by float in section 05.\n\nItem\tHigh vs median\tHighest sale\tMedian sale\tSales\tCheck it\n★ Talon Knife | Case Hardened (Minimal Wear)\t+884%\t$4,588\t$466\t16\tSkinport CSFloat Steam\nDesert Eagle | Cobalt Disruption (Factory New)\t+859%\t$1,210\t$126\t115\tSkinport CSFloat Steam\nAWP | BOOM (Minimal Wear)\t+814%\t$1,232\t$135\t89\tSkinport CSFloat Steam\nAK-47 | Case Hardened (Well-Worn)\t+769%\t$1,720\t$198\t70\tSkinport CSFloat Steam\nAWP | Graphite (Factory New)\t+761%\t$1,469\t$171\t124\tSkinport CSFloat Steam\n★ Talon Knife | Case Hardened (Field-Tested)\t+509%\t$2,437\t$400\t48\tSkinport CSFloat Steam\n★ Kukri Knife | Case Hardened (Minimal Wear)\t+448%\t$723\t$132\t69\tSkinport CSFloat Steam\n★ Kukri Knife | Case Hardened (Field-Tested)\t+415%\t$549\t$106\t128\tSkinport CSFloat Steam\n★ Ursus Knife | Case Hardened (Minimal Wear)\t+371%\t$597\t$127\t12\tSkinport CSFloat Steam\nAK-47 | Case Hardened (Field-Tested)\t+369%\t$1,037\t$221\t125\tSkinport CSFloat Steam\nAK-47 | Red Laminate (Minimal Wear)\t+360%\t$552\t$120\t18\tSkinport CSFloat Steam\nAWP | Asiimov (Field-Tested)\t+351%\t$528\t$117\t439\tSkinport CSFloat Steam\nAK-47 | Vulcan (Field-Tested)\t+337%\t$865\t$198\t241\tSkinport CSFloat Steam\nStatTrak™ AK-47 | Nightwish (Factory New)\t+322%\t$625\t$148\t31\tSkinport CSFloat Steam\nAWP | Lightning Strike (Factory New)\t+319%\t$2,065\t$493\t198\tSkinport CSFloat Steam\nStatTrak™ AWP | Redline (Minimal Wear)\t+312%\t$574\t$139\t24\tSkinport CSFloat Steam\nStatTrak™ AWP | Asiimov (Battle-Scarred)\t+287%\t$524\t$135\t37\tSkinport CSFloat Steam\nAK-47 | Redline (Minimal Wear)\t+277%\t$562\t$149\t112\tSkinport CSFloat Steam\nAWP | Crakow! (Factory New)\t+275%\t$379\t$101\t72\tSkinport CSFloat Steam\nStatTrak™ AK-47 | Vulcan (Factory New)\t+272%\t$5,275\t$1,418\t12\tSkinport CSFloat Steam\n\nThis is a 90-day high, NOT an all-time high, and it covers ONE marketplace. No all-time figure is claimed anywhere in this dossier. An item with no Skinport sale in the window is absent from this exhibit entirely, which is why the set is smaller than the census.\n\nVerification links are built from the catalogue's own platform identifiers. They point at each marketplace's page for the item so a reader can check the figure against the source rather than against us. Outbound links carry rel=\"nofollow\": they are citations, not endorsements, and several of the destinations are marketplaces this investigation is critical of.\n\n09 / provenance and limits\nWhere this came from and what it cannot show\n\nEvery figure on this page is recomputed from two snapshot files whose hashes are published alongside them. Nothing here is transcribed from another site’s article.\n\nSource and access\n\ncs2.sh API, GET /v1/prices/latest and GET /v1/schema, single snapshot, captured 2026-09-23T00:44:27.871388581Z, priced in USD.\n\nThe data was obtained under a paid commercial subscription held by the GDPR requester documented in the archive, under the provider’s own terms. No marketplace was scraped and no credential of any marketplace was used. The requester’s key is held outside this repository and appears in no file here.\n\nHow an item qualifies\n\nEvery base item with at least one live ask on BUFF, CSFloat, Skinport, YouPin or C5Game is placed in a price band by its CHEAPEST such ask, so the band never depends on Steam. \"Steam coverage\" is the share of the items in that band carrying any live Steam ask at the moment of capture. Pattern and phase variants are excluded from the ladder because Steam does not list them separately; including them would understate Steam. Renders are the catalogue images for the same items, stored locally.\n\nRenders and image rights. Catalogue item renders are the provider's images served for the same market_hash_name as the price rows, stored locally for offline and IPFS display. The renders are not PhishDestroy's work: all item imagery, logos and screenshots remain the property of their respective owners (cs2.sh, CSFloat, Skinport, BUFF, YouPin, C5Game, Valve and others). They are reproduced solely for identification and public-interest reporting; no ownership or licence is claimed.\n\nWhat we could not obtain\n\nThe subscription tier used serves current snapshots only. Historical and archive endpoints were not available, and no historical series is claimed anywhere on this page beyond the trailing-window sales Skinport publishes itself in section 06.\n\nOne snapshot, not a time series. Absence of a Steam listing at the moment of capture is not proof an item may never appear there; it is the measured state of the shelf at that moment, and for prices above the cap it is also what Valve's published rule requires: Valve's Community Market explicitly caps listings at $1,800 per item (with a maximum Steam Wallet balance of $2,000; see Steam Community Market FAQ archived 2026-09-21 ↗ and Steam Subscriber Agreement § 3.C archived 2026-09-24 ↗).\n\nGrading\n\nAn item's price is always its cheapest live ask, so a high outlier can never inflate a total. Grading governs which rows may be quoted. Any quote more than three times the cheapest ask on the same item is set aside as not a live price. Grade A: three or more marketplaces still quote above the cap and their median sits within 25 per cent of the cheapest. Grade B: two marketplaces agree, or three agree less tightly. Grade C: a single shelf - an asking price, not a market price. Only grades A and B are quoted anywhere in this dossier.\n\nOutlier rule: quote > 3.0x the cheapest ask on the same item.\n\nWhy the totals are a floor\n\nFor each marketplace the item’s lowest ask is multiplied by the number of copies that shelf lists. Every other copy there is priced at or above that lowest ask, so the true posted value is higher by construction, not by estimate. It is not a sale, not a cash flow, and not a valuation of the CS2 economy.\n\nCheck it yourself\n\nThe derived datasets behind every chart on this page are published in full: the atlas dataset, the grading and artefact screen, the underlying census and the manifest with the SHA-256 of each raw snapshot.\n\nA correction recorded in the open\n\nAn earlier draft of the companion register led with a Souvenir AK-47 | Point Disarray asked at $148,954 on one Chinese marketplace while Steam priced it at $119. That row is grade C: a single shelf, a single copy, and no second marketplace agreeing. It is an asking price, not a price, and it has been demoted here and on that page. The corroborated leader is Sticker | Titan (Holo) | Katowice 2014 at $66,285, quoted by 4 marketplaces within 5.2% of each other — and absent from Steam entirely.",
        "headings": [
          {
            "level": 1,
            "id": null,
            "text": "Skin Price-Ladder Atlas — The Liquidity Cliff"
          },
          {
            "level": 2,
            "id": null,
            "text": "The cliff lands on the rule, not on demand"
          },
          {
            "level": 3,
            "id": null,
            "text": "What the shape rules out"
          },
          {
            "level": 2,
            "id": null,
            "text": "An asking price is not a price"
          },
          {
            "level": 3,
            "id": null,
            "text": "A  Three or more shelves agree"
          },
          {
            "level": 3,
            "id": null,
            "text": "B  Two shelves agree"
          },
          {
            "level": 3,
            "id": null,
            "text": "C  One shelf — not used"
          },
          {
            "level": 3,
            "id": null,
            "text": "What this correction cost, and what it bought"
          },
          {
            "level": 3,
            "id": null,
            "text": "Listings set aside as artefacts"
          },
          {
            "level": 2,
            "id": null,
            "text": "All 419 categories, with the object each price refers to"
          },
          {
            "level": 2,
            "id": null,
            "text": "The shelves that carry what Steam will not"
          },
          {
            "level": 2,
            "id": null,
            "text": "How thin the supply actually is"
          },
          {
            "level": 2,
            "id": null,
            "text": "What the third-party shelves actually realised"
          },
          {
            "level": 2,
            "id": null,
            "text": "Sixteen-year-old stickers and a handful of gloves"
          },
          {
            "level": 2,
            "id": null,
            "text": "Highs backed by a transaction, not by a listing"
          },
          {
            "level": 3,
            "id": null,
            "text": "The thirty highest completed sales in the window"
          },
          {
            "level": 3,
            "id": null,
            "text": "Same item, same 90 days, wildly different price"
          },
          {
            "level": 2,
            "id": null,
            "text": "Where this came from and what it cannot show"
          },
          {
            "level": 3,
            "id": null,
            "text": "Source and access"
          },
          {
            "level": 3,
            "id": null,
            "text": "How an item qualifies"
          },
          {
            "level": 3,
            "id": null,
            "text": "What we could not obtain"
          },
          {
            "level": 3,
            "id": null,
            "text": "Grading"
          },
          {
            "level": 3,
            "id": null,
            "text": "Why the totals are a floor"
          },
          {
            "level": 3,
            "id": null,
            "text": "Check it yourself"
          },
          {
            "level": 3,
            "id": null,
            "text": "A correction recorded in the open"
          }
        ],
        "links": [
          "https://phishdestroy.io/steam_dossier/de/skin_atlas.html",
          "https://phishdestroy.io/steam_dossier/de/#briefing-heading",
          "https://phishdestroy.io/steam_dossier/skin_atlas#gallery",
          "https://skinport.com/market?search=AWP%20%7C%20Gungnir%20%28Factory%20New%29",
          "https://csfloat.com/search?market_hash_name=AWP%20%7C%20Gungnir%20%28Factory%20New%29",
          "https://steamcommunity.com/market/listings/730/AWP%20%7C%20Gungnir%20%28Factory%20New%29",
          "https://skinport.com/market?search=StatTrak%E2%84%A2%20M4A4%20%7C%20Howl%20%28Factory%20New%29",
          "https://csfloat.com/search?market_hash_name=StatTrak%E2%84%A2%20M4A4%20%7C%20Howl%20%28Factory%20New%29",
          "https://steamcommunity.com/market/listings/730/StatTrak%E2%84%A2%20M4A4%20%7C%20Howl%20%28Factory%20New%29",
          "https://skinport.com/market?search=AWP%20%7C%20Dragon%20Lore%20%28Factory%20New%29",
          "https://csfloat.com/search?market_hash_name=AWP%20%7C%20Dragon%20Lore%20%28Factory%20New%29",
          "https://steamcommunity.com/market/listings/730/AWP%20%7C%20Dragon%20Lore%20%28Factory%20New%29",
          "https://skinport.com/market?search=AK-47%20%7C%20Wild%20Lotus%20%28Minimal%20Wear%29",
          "https://csfloat.com/search?market_hash_name=AK-47%20%7C%20Wild%20Lotus%20%28Minimal%20Wear%29",
          "https://steamcommunity.com/market/listings/730/AK-47%20%7C%20Wild%20Lotus%20%28Minimal%20Wear%29",
          "https://skinport.com/market?search=AWP%20%7C%20Gungnir%20%28Minimal%20Wear%29",
          "https://csfloat.com/search?market_hash_name=AWP%20%7C%20Gungnir%20%28Minimal%20Wear%29",
          "https://steamcommunity.com/market/listings/730/AWP%20%7C%20Gungnir%20%28Minimal%20Wear%29",
          "https://skinport.com/market?search=StatTrak%E2%84%A2%20AK-47%20%7C%20Blue%20Laminate%20%28Minimal%20Wear%29",
          "https://csfloat.com/search?market_hash_name=StatTrak%E2%84%A2%20AK-47%20%7C%20Blue%20Laminate%20%28Minimal%20Wear%29",
          "https://steamcommunity.com/market/listings/730/StatTrak%E2%84%A2%20AK-47%20%7C%20Blue%20Laminate%20%28Minimal%20Wear%29",
          "https://skinport.com/market?search=StatTrak%E2%84%A2%20M4A4%20%7C%20Howl%20%28Minimal%20Wear%29",
          "https://csfloat.com/search?market_hash_name=StatTrak%E2%84%A2%20M4A4%20%7C%20Howl%20%28Minimal%20Wear%29",
          "https://steamcommunity.com/market/listings/730/StatTrak%E2%84%A2%20M4A4%20%7C%20Howl%20%28Minimal%20Wear%29",
          "https://skinport.com/market?search=AWP%20%7C%20Dragon%20Lore%20%28Minimal%20Wear%29",
          "https://csfloat.com/search?market_hash_name=AWP%20%7C%20Dragon%20Lore%20%28Minimal%20Wear%29",
          "https://steamcommunity.com/market/listings/730/AWP%20%7C%20Dragon%20Lore%20%28Minimal%20Wear%29",
          "https://skinport.com/market?search=%E2%98%85%20Sport%20Gloves%20%7C%20Hedge%20Maze%20%28Minimal%20Wear%29",
          "https://csfloat.com/search?market_hash_name=%E2%98%85%20Sport%20Gloves%20%7C%20Hedge%20Maze%20%28Minimal%20Wear%29",
          "https://steamcommunity.com/market/listings/730/%E2%98%85%20Sport%20Gloves%20%7C%20Hedge%20Maze%20%28Minimal%20Wear%29",
          "https://skinport.com/market?search=AK-47%20%7C%20Wild%20Lotus%20%28Field-Tested%29",
          "https://csfloat.com/search?market_hash_name=AK-47%20%7C%20Wild%20Lotus%20%28Field-Tested%29",
          "https://steamcommunity.com/market/listings/730/AK-47%20%7C%20Wild%20Lotus%20%28Field-Tested%29",
          "https://skinport.com/market?search=StatTrak%E2%84%A2%20M4A4%20%7C%20Howl%20%28Field-Tested%29",
          "https://csfloat.com/search?market_hash_name=StatTrak%E2%84%A2%20M4A4%20%7C%20Howl%20%28Field-Tested%29",
          "https://steamcommunity.com/market/listings/730/StatTrak%E2%84%A2%20M4A4%20%7C%20Howl%20%28Field-Tested%29",
          "https://skinport.com/market?search=AWP%20%7C%20Gungnir%20%28Field-Tested%29",
          "https://csfloat.com/search?market_hash_name=AWP%20%7C%20Gungnir%20%28Field-Tested%29",
          "https://steamcommunity.com/market/listings/730/AWP%20%7C%20Gungnir%20%28Field-Tested%29",
          "https://skinport.com/market?search=AWP%20%7C%20Dragon%20Lore%20%28Field-Tested%29",
          "https://csfloat.com/search?market_hash_name=AWP%20%7C%20Dragon%20Lore%20%28Field-Tested%29",
          "https://steamcommunity.com/market/listings/730/AWP%20%7C%20Dragon%20Lore%20%28Field-Tested%29",
          "https://skinport.com/market?search=M4A4%20%7C%20Howl%20%28Factory%20New%29",
          "https://csfloat.com/search?market_hash_name=M4A4%20%7C%20Howl%20%28Factory%20New%29",
          "https://steamcommunity.com/market/listings/730/M4A4%20%7C%20Howl%20%28Factory%20New%29",
          "https://skinport.com/market?search=%E2%98%85%20Sport%20Gloves%20%7C%20Superconductor%20%28Factory%20New%29",
          "https://csfloat.com/search?market_hash_name=%E2%98%85%20Sport%20Gloves%20%7C%20Superconductor%20%28Factory%20New%29",
          "https://steamcommunity.com/market/listings/730/%E2%98%85%20Sport%20Gloves%20%7C%20Superconductor%20%28Factory%20New%29",
          "https://skinport.com/market?search=AWP%20%7C%20Gungnir%20%28Battle-Scarred%29",
          "https://csfloat.com/search?market_hash_name=AWP%20%7C%20Gungnir%20%28Battle-Scarred%29",
          "https://steamcommunity.com/market/listings/730/AWP%20%7C%20Gungnir%20%28Battle-Scarred%29",
          "https://skinport.com/market?search=%E2%98%85%20Sport%20Gloves%20%7C%20Pandora%27s%20Box%20%28Minimal%20Wear%29",
          "https://csfloat.com/search?market_hash_name=%E2%98%85%20Sport%20Gloves%20%7C%20Pandora%27s%20Box%20%28Minimal%20Wear%29",
          "https://steamcommunity.com/market/listings/730/%E2%98%85%20Sport%20Gloves%20%7C%20Pandora%27s%20Box%20%28Minimal%20Wear%29",
          "https://skinport.com/market?search=%E2%98%85%20Sport%20Gloves%20%7C%20Vice%20%28Factory%20New%29",
          "https://csfloat.com/search?market_hash_name=%E2%98%85%20Sport%20Gloves%20%7C%20Vice%20%28Factory%20New%29",
          "https://steamcommunity.com/market/listings/730/%E2%98%85%20Sport%20Gloves%20%7C%20Vice%20%28Factory%20New%29",
          "https://skinport.com/market?search=M4A4%20%7C%20Howl%20%28Minimal%20Wear%29",
          "https://csfloat.com/search?market_hash_name=M4A4%20%7C%20Howl%20%28Minimal%20Wear%29",
          "https://steamcommunity.com/market/listings/730/M4A4%20%7C%20Howl%20%28Minimal%20Wear%29",
          "https://skinport.com/market?search=%E2%98%85%20Sport%20Gloves%20%7C%20Hedge%20Maze%20%28Field-Tested%29",
          "https://csfloat.com/search?market_hash_name=%E2%98%85%20Sport%20Gloves%20%7C%20Hedge%20Maze%20%28Field-Tested%29",
          "https://steamcommunity.com/market/listings/730/%E2%98%85%20Sport%20Gloves%20%7C%20Hedge%20Maze%20%28Field-Tested%29",
          "https://skinport.com/market?search=StatTrak%E2%84%A2%20AK-47%20%7C%20Vulcan%20%28Factory%20New%29",
          "https://csfloat.com/search?market_hash_name=StatTrak%E2%84%A2%20AK-47%20%7C%20Vulcan%20%28Factory%20New%29",
          "https://steamcommunity.com/market/listings/730/StatTrak%E2%84%A2%20AK-47%20%7C%20Vulcan%20%28Factory%20New%29",
          "https://skinport.com/market?search=AK-47%20%7C%20Wild%20Lotus%20%28Well-Worn%29",
          "https://csfloat.com/search?market_hash_name=AK-47%20%7C%20Wild%20Lotus%20%28Well-Worn%29",
          "https://steamcommunity.com/market/listings/730/AK-47%20%7C%20Wild%20Lotus%20%28Well-Worn%29",
          "https://skinport.com/market?search=AWP%20%7C%20Dragon%20Lore%20%28Well-Worn%29",
          "https://csfloat.com/search?market_hash_name=AWP%20%7C%20Dragon%20Lore%20%28Well-Worn%29",
          "https://steamcommunity.com/market/listings/730/AWP%20%7C%20Dragon%20Lore%20%28Well-Worn%29",
          "https://skinport.com/market?search=AK-47%20%7C%20Hydroponic%20%28Factory%20New%29",
          "https://csfloat.com/search?market_hash_name=AK-47%20%7C%20Hydroponic%20%28Factory%20New%29",
          "https://steamcommunity.com/market/listings/730/AK-47%20%7C%20Hydroponic%20%28Factory%20New%29",
          "https://skinport.com/market?search=%E2%98%85%20Talon%20Knife%20%7C%20Case%20Hardened%20%28Minimal%20Wear%29",
          "https://csfloat.com/search?market_hash_name=%E2%98%85%20Talon%20Knife%20%7C%20Case%20Hardened%20%28Minimal%20Wear%29",
          "https://steamcommunity.com/market/listings/730/%E2%98%85%20Talon%20Knife%20%7C%20Case%20Hardened%20%28Minimal%20Wear%29",
          "https://skinport.com/market?search=AWP%20%7C%20Medusa%20%28Factory%20New%29",
          "https://csfloat.com/search?market_hash_name=AWP%20%7C%20Medusa%20%28Factory%20New%29",
          "https://steamcommunity.com/market/listings/730/AWP%20%7C%20Medusa%20%28Factory%20New%29",
          "https://skinport.com/market?search=%E2%98%85%20Specialist%20Gloves%20%7C%20Pillow%20Punchers%20%28Factory%20New%29",
          "https://csfloat.com/search?market_hash_name=%E2%98%85%20Specialist%20Gloves%20%7C%20Pillow%20Punchers%20%28Factory%20New%29",
          "https://steamcommunity.com/market/listings/730/%E2%98%85%20Specialist%20Gloves%20%7C%20Pillow%20Punchers%20%28Factory%20New%29",
          "https://skinport.com/market?search=%E2%98%85%20Sport%20Gloves%20%7C%20Pandora%27s%20Box%20%28Field-Tested%29",
          "https://csfloat.com/search?market_hash_name=%E2%98%85%20Sport%20Gloves%20%7C%20Pandora%27s%20Box%20%28Field-Tested%29",
          "https://steamcommunity.com/market/listings/730/%E2%98%85%20Sport%20Gloves%20%7C%20Pandora%27s%20Box%20%28Field-Tested%29",
          "https://skinport.com/market?search=M4A4%20%7C%20Howl%20%28Field-Tested%29",
          "https://csfloat.com/search?market_hash_name=M4A4%20%7C%20Howl%20%28Field-Tested%29",
          "https://steamcommunity.com/market/listings/730/M4A4%20%7C%20Howl%20%28Field-Tested%29",
          "https://skinport.com/market?search=AWP%20%7C%20Dragon%20Lore%20%28Battle-Scarred%29",
          "https://csfloat.com/search?market_hash_name=AWP%20%7C%20Dragon%20Lore%20%28Battle-Scarred%29",
          "https://steamcommunity.com/market/listings/730/AWP%20%7C%20Dragon%20Lore%20%28Battle-Scarred%29",
          "https://skinport.com/market?search=Desert%20Eagle%20%7C%20Cobalt%20Disruption%20%28Factory%20New%29",
          "https://csfloat.com/search?market_hash_name=Desert%20Eagle%20%7C%20Cobalt%20Disruption%20%28Factory%20New%29",
          "https://steamcommunity.com/market/listings/730/Desert%20Eagle%20%7C%20Cobalt%20Disruption%20%28Factory%20New%29",
          "https://skinport.com/market?search=AWP%20%7C%20BOOM%20%28Minimal%20Wear%29",
          "https://csfloat.com/search?market_hash_name=AWP%20%7C%20BOOM%20%28Minimal%20Wear%29",
          "https://steamcommunity.com/market/listings/730/AWP%20%7C%20BOOM%20%28Minimal%20Wear%29",
          "https://skinport.com/market?search=AK-47%20%7C%20Case%20Hardened%20%28Well-Worn%29",
          "https://csfloat.com/search?market_hash_name=AK-47%20%7C%20Case%20Hardened%20%28Well-Worn%29",
          "https://steamcommunity.com/market/listings/730/AK-47%20%7C%20Case%20Hardened%20%28Well-Worn%29",
          "https://skinport.com/market?search=AWP%20%7C%20Graphite%20%28Factory%20New%29",
          "https://csfloat.com/search?market_hash_name=AWP%20%7C%20Graphite%20%28Factory%20New%29",
          "https://steamcommunity.com/market/listings/730/AWP%20%7C%20Graphite%20%28Factory%20New%29",
          "https://skinport.com/market?search=%E2%98%85%20Talon%20Knife%20%7C%20Case%20Hardened%20%28Field-Tested%29",
          "https://csfloat.com/search?market_hash_name=%E2%98%85%20Talon%20Knife%20%7C%20Case%20Hardened%20%28Field-Tested%29",
          "https://steamcommunity.com/market/listings/730/%E2%98%85%20Talon%20Knife%20%7C%20Case%20Hardened%20%28Field-Tested%29",
          "https://skinport.com/market?search=%E2%98%85%20Kukri%20Knife%20%7C%20Case%20Hardened%20%28Minimal%20Wear%29",
          "https://csfloat.com/search?market_hash_name=%E2%98%85%20Kukri%20Knife%20%7C%20Case%20Hardened%20%28Minimal%20Wear%29",
          "https://steamcommunity.com/market/listings/730/%E2%98%85%20Kukri%20Knife%20%7C%20Case%20Hardened%20%28Minimal%20Wear%29",
          "https://skinport.com/market?search=%E2%98%85%20Kukri%20Knife%20%7C%20Case%20Hardened%20%28Field-Tested%29",
          "https://csfloat.com/search?market_hash_name=%E2%98%85%20Kukri%20Knife%20%7C%20Case%20Hardened%20%28Field-Tested%29",
          "https://steamcommunity.com/market/listings/730/%E2%98%85%20Kukri%20Knife%20%7C%20Case%20Hardened%20%28Field-Tested%29",
          "https://skinport.com/market?search=%E2%98%85%20Ursus%20Knife%20%7C%20Case%20Hardened%20%28Minimal%20Wear%29",
          "https://csfloat.com/search?market_hash_name=%E2%98%85%20Ursus%20Knife%20%7C%20Case%20Hardened%20%28Minimal%20Wear%29",
          "https://steamcommunity.com/market/listings/730/%E2%98%85%20Ursus%20Knife%20%7C%20Case%20Hardened%20%28Minimal%20Wear%29",
          "https://skinport.com/market?search=AK-47%20%7C%20Case%20Hardened%20%28Field-Tested%29",
          "https://csfloat.com/search?market_hash_name=AK-47%20%7C%20Case%20Hardened%20%28Field-Tested%29",
          "https://steamcommunity.com/market/listings/730/AK-47%20%7C%20Case%20Hardened%20%28Field-Tested%29",
          "https://skinport.com/market?search=AK-47%20%7C%20Red%20Laminate%20%28Minimal%20Wear%29",
          "https://csfloat.com/search?market_hash_name=AK-47%20%7C%20Red%20Laminate%20%28Minimal%20Wear%29",
          "https://steamcommunity.com/market/listings/730/AK-47%20%7C%20Red%20Laminate%20%28Minimal%20Wear%29",
          "https://skinport.com/market?search=AWP%20%7C%20Asiimov%20%28Field-Tested%29",
          "https://csfloat.com/search?market_hash_name=AWP%20%7C%20Asiimov%20%28Field-Tested%29",
          "https://steamcommunity.com/market/listings/730/AWP%20%7C%20Asiimov%20%28Field-Tested%29",
          "https://skinport.com/market?search=AK-47%20%7C%20Vulcan%20%28Field-Tested%29",
          "https://csfloat.com/search?market_hash_name=AK-47%20%7C%20Vulcan%20%28Field-Tested%29",
          "https://steamcommunity.com/market/listings/730/AK-47%20%7C%20Vulcan%20%28Field-Tested%29",
          "https://skinport.com/market?search=StatTrak%E2%84%A2%20AK-47%20%7C%20Nightwish%20%28Factory%20New%29",
          "https://csfloat.com/search?market_hash_name=StatTrak%E2%84%A2%20AK-47%20%7C%20Nightwish%20%28Factory%20New%29",
          "https://steamcommunity.com/market/listings/730/StatTrak%E2%84%A2%20AK-47%20%7C%20Nightwish%20%28Factory%20New%29",
          "https://skinport.com/market?search=AWP%20%7C%20Lightning%20Strike%20%28Factory%20New%29",
          "https://csfloat.com/search?market_hash_name=AWP%20%7C%20Lightning%20Strike%20%28Factory%20New%29",
          "https://steamcommunity.com/market/listings/730/AWP%20%7C%20Lightning%20Strike%20%28Factory%20New%29",
          "https://skinport.com/market?search=StatTrak%E2%84%A2%20AWP%20%7C%20Redline%20%28Minimal%20Wear%29",
          "https://csfloat.com/search?market_hash_name=StatTrak%E2%84%A2%20AWP%20%7C%20Redline%20%28Minimal%20Wear%29",
          "https://steamcommunity.com/market/listings/730/StatTrak%E2%84%A2%20AWP%20%7C%20Redline%20%28Minimal%20Wear%29",
          "https://skinport.com/market?search=StatTrak%E2%84%A2%20AWP%20%7C%20Asiimov%20%28Battle-Scarred%29",
          "https://csfloat.com/search?market_hash_name=StatTrak%E2%84%A2%20AWP%20%7C%20Asiimov%20%28Battle-Scarred%29",
          "https://steamcommunity.com/market/listings/730/StatTrak%E2%84%A2%20AWP%20%7C%20Asiimov%20%28Battle-Scarred%29",
          "https://skinport.com/market?search=AK-47%20%7C%20Redline%20%28Minimal%20Wear%29",
          "https://csfloat.com/search?market_hash_name=AK-47%20%7C%20Redline%20%28Minimal%20Wear%29",
          "https://steamcommunity.com/market/listings/730/AK-47%20%7C%20Redline%20%28Minimal%20Wear%29",
          "https://skinport.com/market?search=AWP%20%7C%20Crakow%21%20%28Factory%20New%29",
          "https://csfloat.com/search?market_hash_name=AWP%20%7C%20Crakow%21%20%28Factory%20New%29",
          "https://steamcommunity.com/market/listings/730/AWP%20%7C%20Crakow%21%20%28Factory%20New%29",
          "https://help.steampowered.com/en/faqs/view/61F0-72B7-9A18-C70B",
          "http://web.archive.org/web/20260921022227/https://help.steampowered.com/en/faqs/view/61F0-72B7-9A18-C70B",
          "https://store.steampowered.com/subscriber_agreement/",
          "http://web.archive.org/web/20260924114457/https://store.steampowered.com/subscriber_agreement/",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/cs2sh-atlas.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/cs2sh-artefact-screen.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/cs2sh-above-the-ceiling.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/cs2sh-manifest.json"
        ]
      },
      "source_json": "skin_atlas.content.json",
      "source_json_sha256": "c695d7e17d0c6cac357f6341317470f26079ec8410049f18ea9844f763fffa3f"
    },
    {
      "source": "https://phishdestroy.io/steam_dossier/market_economics",
      "language": "en",
      "title": "One infrastructure, two markets — The Steam Dossier",
      "start_page": 161,
      "end_page": 167,
      "editorial_scope": {
        "policy": "Research prose, conclusions, methodological limits and analytical tables retained without paragraph truncation. Named catalogues and visual galleries are linked; raster images are not embedded.",
        "linked_sections": [],
        "raster_images_replaced": 0
      },
      "content": {
        "text": "Dieses Material ist auf Englisch verfügbar.Zurück zum Dossier · Deutsch ↗\nExhibit VII · Market Architecture · 20 September 2026\nMarket Economics — Two Economies & The Listing Ceiling\n\nTheir infrastructure. Two economies.\n\nWHAT THIS SECTION PROVES\n\nThis chapter analyzes the systemic market bifurcation created by Valve's $1,800 listing cap and non-withdrawable wallet balances. By surveying 38 active external skin exchanges holding approximately $1.28 billion in listed valuation, the investigation proves that high-tier trading necessarily migrates to external shadow platforms while relying on Steam's underlying trade and authentication infrastructure. While commercial use is formally prohibited in the Subscriber Agreement, Valve facilitates and monetizes this two-tier economy without published enforcement records.\n\n← Back to Executive briefing\n\n38 active third-party CS2 marketplaces, plus Steam's own. Every skin listed on any of them must move through Steam's inventory and trade API. Valve's rules prohibit commercial exploitation of that infrastructure. The roughly $1.28 billion third-party listed value exists while no public record of enforcing the rule has been located.\n\n$1.28B\nThird-party listed value · 38 platforms\n53.2M\nDisplayed offers · 38 third-party markets\n70.1K\nSteam items listed in the snapshot\n41×\nThird-party listed value vs Steam's $31M\nThe central finding\nOne infrastructure. Two economies.\n\nSteam controls the item, the inventory, and the trade. Every skin sold on any platform below must move through Steam's trade API — a structural dependence that is directly observable. Valve's own Community Market earns a fee on its sales; whether that fee funds, or is tied to, the third-party ecosystem is not established here.\n\nWhy this matters for the investigation\n1\nValve's Steam Subscriber Agreement prohibits commercial exploitation of Steam infrastructure without express permission. No such permission has been located in the public record for the platforms below.\n2\nSteam controls identity (OpenID), inventory state, and trade execution for the roughly $1.28B third-party listed value. No item transfer happens without Valve's infrastructure.\n3\nSteam's own marketplace has $31M listed — about 1/41 of the third-party listed value. The $1,800 price cap means sellers above it must go off-platform to sell at observed prices.\n4\n248 CS2 item categories, each priced above the cap by two or more marketplaces independently, cannot be sold at their observed market price on Steam — and none of them is listed there at all. The $1,800 cap creates the demand that third-party operators fill.\nSteam Community Market: $31MThird-party listed value: $1,276M\n$1,276M · third-party listed value — all dependent on Steam's trade API & OpenID\nSteam · $31M\n\nSource: PriceEmpire real-time catalogue, 20 September 2026. Listed value = sum of the rounded listed-value cards in the saved snapshot, Steam excluded. Not sales volume.\n\n38 active third-party markets · All depending on Steam infrastructure\nPlatform register\n\nThe platforms below route their logins through Steam OpenID and their trades through Steam's Web API. Each observed openid.realm passes through Steam's login flow; the register records the observed auth routes rather than asserting that any given operator lacks Valve's permission.\n\n#\tPlatform\tListed value\tActive offers\tItems\tScale\n1\tUUSkins\t$133.8M\t3.4M\t30.9K\t\n\n2\tYouPin898\t$127.5M\t5.9M\t29.2K\t\n\n3\tBuff.163\t$104M\t3.5M\t35K\t\n\n4\tMoon.Market\t$100.3M\t2.9M\t20.9K\t\n\n5\tWhite.Market\t$89.6M\t3M\t20.6K\t\n\n6\tBuff.Market\t$86.7M\t1.3M\t33.4K\t\n\n7\tEcosteam\t$82.1M\t3.3M\t30.1K\t\n\n8\tCSFloat\t$67.8M\t2.4M\t27.8K\t\n\n9\tSkin.Land\t$67.4M\t2.2M\t34.6K\t\n\n10\tLIS-SKINS\t$67.4M\t2.2M\t34.6K\t\n\n11\tC5Game\t$54.6M\t4.6M\t29.6K\t\n\n12\tHaloSkins\t$46.6M\t4.4M\t29.3K\t\n\n13\tAvan.Market\t$43.3M\t809.5K\t22.2K\t\n\n14\tWaxpeer\t$40.1M\t1M\t27.3K\t\n\n15\tSteam (official)\t$31M\t32.2M\t70.1K\t\n\n16\tCS.MONEY\t$29M\t748.9K\t28K\t\n\n17\tMarket.CSGO\t$26.3M\t1.3M\t27.6K\t\n\n18\tCS.MONEY Bot\t$25.7M\t614K\t23.8K\t\n\n19\tSkinport\t$16.3M\t3.8M\t31.1K\t\n\n20\tSkinFlow\t$14.1M\t481.8K\t23.6K\t\n\n21\tDMarket\t$12.6M\t948.2K\t35.6K\t\n\n22\tSkins.com\t$11.5M\t83.2K\t15.8K\t\n\n23\tSkin.place\t$6.9M\t380.8K\t11.4K\t\n\n24\tSkinsMonkey\t$6M\t109.4K\t11.6K\t\n\n25\tSkinBaron\t$5M\t2.1M\t21.5K\t\n\n26\tRustTM\t$3M\t33.1K\t4.9K\t\n\n27\tPirateSwap\t$2M\t859.3K\t10.5K\t\n\n28\tMannco.Store\t$1.2M\t223.7K\t11K\t\n\n29\tSkinSwap\t$1.1M\t11.4K\t4K\t\n\n30\tTradeIt\t$967.1K\t29.1K\t11.7K\t\n\n31\tLootFarm\t$896.1K\t162.5K\t28.6K\t\n\n32\tRustskins\t$714.8K\t312.5K\t6.1K\t\n\n33\tBalticSkins\t$599.2K\t28.2K\t4.5K\t\n\n34\tExeSkins\t$442.9K\t2.6K\t1.4K\t\n\n35\tRapidSkins\t$230.9K\t11.6K\t2.3K\t\n\n36\tCS.Trade\t$203K\t19K\t16.7K\t\n\n37\tKrakatoa\t$11.1K\t115\t53\t\n\n38\tShadowPay\t—\t—\t—\t—\n39\t49skins\t—\t—\t—\t—\nSteam's $1,800 price ceiling · five-marketplace snapshot · 23 September 2026\nThe price gap is measurable.\n\nSteam caps Community Market listings at approximately $1,800 (the finding is re-computed at $2,000, $2,070, $2,300 and $2,500 in cs2sh-atlas.json and holds at every threshold). Items observed above that price cannot be sold at their market price through Valve's own marketplace — but they still depend on Steam's inventory and transfer system wherever they are sold. Banding the whole catalogue by price shows where the wall stands: Valve's market carries 95.3% of the item categories priced below its cap and 1.9% of those above it.\n\nFive marketplaces: items above the Steam cap\n248\n\nItem categories whose cheapest ask clears $1,800 on two or more marketplaces independently, holding 18,394 listed copies worth at least $78.6M. Of those, 100.0% — every single one — have no Steam listing at all.\n\nFull exhibits: the register → · the price-ladder atlas →\n\nPrice distribution above cap\n$1,800–$5,000\n174\n$5,000–$10,000\n49\n$10,000–$25,000\n21\n$25,000–$50,000\n2\n$50,000+\n2\nTop items — cheapest corroborated ask across five marketplaces\n1Sticker | Titan (Holo) | Kat. '14$66,285\n2Sticker | iBUYPOWER (Holo) | Kat. '14$64,795\n3Sticker | Reason Gaming (Holo) | Kat. '14$42,899\n4★ Sport Gloves | Hedge Maze (FN)$26,812\n5Sticker | Team Dignitas (Holo) | Kat. '14$23,667\n6EMS Kat. '14 Legends$22,879\n7★ Sport Gloves | Pandora's Box (FN)$21,643\n8EMS Kat. '14 Challengers$21,010\n9Sticker | Vox Eminor (Holo) | Kat. '14$18,619\n10★ StatTrak™ Navaja Knife | Blue Steel (FN)$18,064\n\nAsking prices are not sale prices. Licensed cs2.sh snapshot, 23 September 2026. Every row is quoted above the cap by at least two marketplaces independently; single-shelf asks and quotes more than three times an item's cheapest ask are excluded. How the grading works →\n\nWhat Valve charges · licensed cs2.sh snapshot · 23 September 2026\nThe advertised fee is 15%. Most listings pay more.\n\nValve takes a 5% Steam fee and a 10% CS2 publisher fee from the seller's proceeds — the familiar 15%. Both fees carry a $0.01 minimum, so no sale can ever carry less than two cents in fees. On the cheap, high-volume items that make up the bulk of the market, that floor is the binding constraint, not the percentage. We solved the fee arithmetic for every one of the 29,635 item types carrying a live Steam ask.\n\n77.7%\nof live Steam listings sit on item types charged above 15%\n84.8%\nof item types do pay about the headline rate\n4,517\nitem types charged more than the advertised fee\n$0.02\nminimum fee on any sale, whatever the price\nThe two numbers point opposite ways, and both are true\n1\nCounted by item type, Valve's fee is broadly as advertised: 84.8% of the 29,635 priced types are charged at or near 15%.\n2\nCounted by actual listing, the picture inverts: 18,682,244 of 24,038,911 live listings are on item types charged more than 15%.\n3\nBoth are true because the overcharged types are the cheap, high-volume ones. 1,109 item types are charged more than double the headline rate, and those types alone carry 14,083,486 live listings.\n4\nThis is arithmetic, not an allegation. The minimum is disclosed in Valve's own fee documentation. What has not been published is how much of the market it actually applies to — which is what the figures above measure.\nFee charged, as a share of the headline 15%\n200%+\n14,083,486\n100-200%\n1,028,438\n50-100%\n700,804\n30-50%\n317,031\n20-30%\n2,258,254\n17.6-20%\n294,231\n\nBar length is the number of live listings in each band. A band of “200%+” means the fee taken is more than twice 15% of the seller's proceeds.\n\nA worked example\n67%\n\nOn a listing a buyer pays $0.03 for, the seller receives $0.01 and Valve takes $0.02 — the two one-cent minimums. As a share of what the buyer paid that is 67%; as a share of the seller's proceeds it is 200%.\n\nFull dataset: cs2sh-steam-fee-census.json →\n\nThe same item, inside the garden and outside it\nBuying on Steam costs more. Almost always.\n\nFor every item quoted both on Steam and on at least one third-party marketplace, we compared Steam's cheapest ask with the cheapest ask outside it. Across 28,700 items, Steam is the dearer venue 86.4% of the time, by a median of +35.7%.\n\nMedian Steam premium, by price band\nunder $0.50\n+48.3%\n$0.50-2\n+36.5%\n$2-10\n+29.6%\n$10-50\n+28.6%\n$50-250\n+36.3%\n$250-1k\n+51.1%\nover $1,000\n+67.9%\n\nThe curve is U-shaped. It is cheapest to buy on Steam in the $10–$50 band and dearest at the two ends.\n\nWhy the expensive end matters\n+67.9%\n\nAbove $1,000, the median Steam listing costs 67.9% more than the cheapest offer outside it — and only 1,040 such listings exist on Steam at all.\n\nPast roughly $1,800 the comparison stops being possible, because Valve's rule forbids the listing entirely. Steam's coverage of the items above its own cap is 1.9%. See the whole ladder →\n\nFull dataset: cs2sh-walled-garden-premium.json →\n\nA premium is not on its own a finding: Steam offers instant delivery and no counterparty risk, and buyers may reasonably pay for that. What is measurable is the size of the gap and the fact that the money crossing it cannot come back out — which is the next section.\n\nMoney in, no money out\n$128.1 million committed to orders that cannot be withdrawn.\n\nA Steam buy order is pre-funded: the money leaves the buyer's wallet the moment the order is placed. Steam wallet funds cannot be withdrawn — they can only be spent inside Steam. Summing every price level of every tracked item's buy book gives a census of committed, non-exitable money.\n\n$128.1M\ncommitted to standing Steam buy orders\n170.6M\nindividual funded buy orders standing\n$105.8M\nasking value of the listings facing them\n$15.9M\nValve's cut if every listing sold at its ask\nWhat this figure is, and what it is not\n1\nIt is real money already paid in. Every dollar counted has been debited from a wallet and is sitting against an open order across 31,253 item types.\n2\nIt is not revenue and not a claim about Valve's balance sheet. Where the float is held, and on whose books, is not established here.\n3\nIt is a snapshot, not a flow. Orders are cancellable by the buyer, which returns funds to the wallet — but still not out of Steam.\n4\nThe one-way door is the point. A marketplace whose currency cannot be cashed out is the reason a stolen inventory is converted off Steam rather than on it.\n\nMethod: every price level of every tracked buy book, multiplied by the orders standing at that level. Full dataset: cs2sh-steam-locked-capital.json →\n\nCompleted sales, not asking prices · one marketplace · trailing 90 days\n$30.9 million actually changed hands — on the smallest of the five shelves.\n\nA single high sale can be a rare craft or sticker-applied variant of a cheap base item (e.g. a $30 item with a one-off $9,772 completed sale). \"High\" = highest completed transaction, not the item's normal price.\n\nEvery other figure on this page measures what is listed. This one measures what was sold. Skinport publishes its own completed transactions, and over the trailing 90 days they came to 1,219,143 sales worth $30,927,032, at an average of $25.37 each.\n\n1.22M\ncompleted sales in 90 days, one marketplace\n$30.9M\nturnover over the same window\n$125M\nannualised run rate — a floor, not an estimate\n~2%\nSkinport's share of the above-cap shelf by listed value\nWhere the turnover came from\nunder $1\n0.5%\n$1-10\n5.8%\n$10-100\n22.2%\n$100-1k\n59.4%\n$1k-1.8k\n6.9%\nabove the Steam cap\n5.3%\n\nBar length is turnover; the figure is that tier's share of the total. 59.4% of the money moved in the $100–$1k tier, on 71,437 sales.\n\nAbove Valve's cap, sales still happen\n492\n\ncompleted sales of items priced above the Steam cap, worth $1,643,938, across 76 item types — on a marketplace that holds roughly 2% of that shelf. None of those sales could have taken place on Steam.\n\nFull dataset: cs2sh-offsteam-90d-dynamics.json → · the realised highs →\n\nSkinport is ONE of the third-party markets tracked here, and by listing value above the Steam cap it is the smallest of the five (about 2% of that shelf). Every total here is a floor on the off-Steam economy, not a measure of it. No Steam data is used.",
        "headings": [
          {
            "level": 1,
            "id": null,
            "text": "Market Economics — Two Economies & The Listing Ceiling"
          },
          {
            "level": 2,
            "id": null,
            "text": "One infrastructure. Two economies."
          },
          {
            "level": 2,
            "id": null,
            "text": "Platform register"
          },
          {
            "level": 2,
            "id": null,
            "text": "The price gap is measurable."
          },
          {
            "level": 3,
            "id": null,
            "text": "Five marketplaces: items above the Steam cap"
          },
          {
            "level": 3,
            "id": null,
            "text": "Price distribution above cap"
          },
          {
            "level": 3,
            "id": null,
            "text": "Top items — cheapest corroborated ask across five marketplaces"
          },
          {
            "level": 2,
            "id": null,
            "text": "The advertised fee is 15%. Most listings pay more."
          },
          {
            "level": 3,
            "id": null,
            "text": "Fee charged, as a share of the headline 15%"
          },
          {
            "level": 3,
            "id": null,
            "text": "A worked example"
          },
          {
            "level": 2,
            "id": null,
            "text": "Buying on Steam costs more. Almost always."
          },
          {
            "level": 3,
            "id": null,
            "text": "Median Steam premium, by price band"
          },
          {
            "level": 3,
            "id": null,
            "text": "Why the expensive end matters"
          },
          {
            "level": 2,
            "id": null,
            "text": "$128.1 million committed to orders that cannot be withdrawn."
          },
          {
            "level": 2,
            "id": null,
            "text": "$30.9 million actually changed hands — on the smallest of the five shelves."
          },
          {
            "level": 3,
            "id": null,
            "text": "Where the turnover came from"
          },
          {
            "level": 3,
            "id": null,
            "text": "Above Valve's cap, sales still happen"
          }
        ],
        "links": [
          "https://phishdestroy.io/steam_dossier/de/market_economics.html",
          "https://phishdestroy.io/steam_dossier/de/#briefing-heading",
          "https://phishdestroy.io/steam_dossier/de/elite_skins.html",
          "https://phishdestroy.io/steam_dossier/de/skin_atlas.html",
          "https://phishdestroy.io/steam_dossier/de/skin_atlas.html#grading",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/cs2sh-steam-fee-census.json",
          "https://phishdestroy.io/steam_dossier/de/skin_atlas.html#cliff",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/cs2sh-walled-garden-premium.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/cs2sh-steam-locked-capital.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/cs2sh-offsteam-90d-dynamics.json",
          "https://phishdestroy.io/steam_dossier/de/skin_atlas.html#highs"
        ]
      },
      "source_json": "market_economics.content.json",
      "source_json_sha256": "0a4721d03b7372a707b05974fb31046cceb436bcaf5956525229ea9d0a6e021b"
    },
    {
      "source": "https://phishdestroy.io/steam_dossier/legal_analysis",
      "language": "en",
      "title": "Their terms, your rights — The Steam Dossier",
      "start_page": 168,
      "end_page": 174,
      "editorial_scope": {
        "policy": "Research prose, conclusions, methodological limits and analytical tables retained without paragraph truncation. Named catalogues and visual galleries are linked; raster images are not embedded.",
        "linked_sections": [],
        "raster_images_replaced": 0
      },
      "content": {
        "text": "Dieses Material ist auf Englisch verfügbar.Zurück zum Dossier · Deutsch ↗\nLegal & economic report\nLegal Analysis — Terms of Service & Regulatory Compliance\n\nTheir terms. Your rights.\n\nWHAT THIS SECTION PROVES\n\nThis forensic legal audit assesses the contractual asymmetry between Valve Corporation and Steam users across key regulatory jurisdictions. It establishes how the revocable subscription license strips statutory consumer ownership, analyzes European Court jurisprudence on digital resale exhaustion, and examines compliance under the Digital Services Act (DSA) and GDPR Art. 15. The analysis demonstrates how automated enforcement mechanisms operate without meaningful appeals while platform market fees systematically extract economic value on every peer transaction.\n\n← Back to Executive briefing\n\nThis report presents a legal, economic and technical analysis of the gap between Steam's declared platform rules and the position of the consumer: automated enforcement with little recourse, and extensive corporate control over digital assets. Figures are stated with their source; where a figure could not be traced to a primary record it has been omitted.\n\nVector 1\n\nReplacing \"ownership\" with a revocable licence, so that digital assets can be withdrawn under the agreement.\n\nVector 2\n\nAutomated enforcement (VACNet) whose bans Steam Support states it cannot reverse.\n\nVector 3\n\nAccount and asset controls combined with a 15% CS2 market fee (5% Steam + 10% publisher fee) that removes value from the ecosystem on every resale.\n\nTerms asymmetry\nLiability waiver and the revocable licence\n2.1 The \"subscription\" model vs. property rights\n\nSection 2 of the Steam Subscriber Agreement grants users only a personal, non-exclusive, non-transferable and revocable licence. Under the agreement, Valve may terminate accounts at any time, and unused Steam Wallet balances may be forfeited.\n\n2.2 The refund illusion vs. the EU Consumer Rights Directive\nLegal framework\tRefund mechanism\tLimitation\nEU Consumer Rights Directive\tUnconditional 14-day right of withdrawal on digital content\tWaived if download begins with explicit consumer consent\nSteam SSA\t14 days / under 2 hours played\tValve may deny at its discretion for \"abuse\"\nAssessment\n\nValve conditions the EU's 14-day statutory withdrawal right on its own \"14 days / under 2 hours\" window, accepted at the moment of download before the product can be evaluated. That policy narrows — not extends — the statutory right; whether it lawfully does so is a question for the competent authority, not a conclusion asserted here.\n\nLitigation\nSecondary Market and Antitrust\nUFC Que Choisir v. Valve — France\n2019\nParis court: the exhaustion-of-rights doctrine applies to digital games — resale is lawful\nOct 2022\nParis Court of Appeal reverses the ruling\n23 Oct 2024\nCour de cassation (Supreme Court): video games are \"complex works\" under the InfoSoc Directive, not software. Digital resale prohibited. Valve prevails.\nWolfire Games antitrust — United States (In re Valve Antitrust Litigation, No. 2:21-cv-00563)\n\nValve's Platform Most-Favored-Nation (PMFN) clause prohibits developers from selling Steam keys more cheaply on any other platform. Competing stores — even those charging 12% commission against Valve's 30% — cannot pass the saving on to consumers.\n\n336total Valve employees (2021). Source: unsealed discovery.\n79employees managing the entire Steam platform. Source: unsealed discovery.\n$3.5Mnet income per employee. Source: unsealed discovery.\n\nUnsealed discovery records show $8.5B gross revenue in 2021 on 336 employees. The 79-person Steam team handled 373,000+ daily support tickets by routing them through outsourced, automated call centres.\n\nUNSEALED DOCKET EXHIBIT · W.D. WASH. CASE 2:21-CV-00563Internal Discovery Memo\n\nTim Sweeney (CEO, Epic Games) to Gabe Newell: \"Why is Steam still taking 30% of gross when payment processing is 2–5% and CDN bandwidth is $0.002/GB? If you subtract out the top 25 games on Steam, I bet Valve made more profit from most of the next 1,000 than the developers themselves made.\"\n\nScott Lynch (COO, Valve Corporation) internal forward to Gabe Newell: \"You mad bro?\"\n\nSworn Deposition Rebuttal (Bloomberg, 2026): Under Rule 30(b)(1) deposition, Gabe Newell testified that \"Valve does not have a policy or practice of dictating prices to third-party software developers on other platforms.\" Plaintiffs confronted Newell with internal Valve memos proving active price policing and delisting threats against developers pricing lower on competing stores. In late March 2026, the Federal Court denied Valve's summary judgment motion, sending the 32,000-developer class action to a jury trial.\nNovember 2024\n\nClass action certified for ~32,000 developers who paid commissions since January 2017, plus a parallel consumer class action.\n\nClaimed damages\n\n$3.1B\nTrebled under US antitrust law = $9.3B potential exposure.\n\nJune 2026: a new lawsuit alleges that Microsoft and Valve engaged in a cartel agreement suppressing competition in PC game distribution.\n\nFinancial Crime & AML Formal Admission\nValve Official Confession: Worldwide Fraud Liquidations (28 October 2019)\n\nOn 28 October 2019, Valve officially terminated the trading and marketplace re-sale of newly purchased Counter-Strike container keys. In its formal public announcement (blog.counter-strike.net/2019/10/26113), Valve Corporation conceded in writing that the virtual economy it architected had become an international money laundering clearinghouse:\n\n\"In the past, most key trades we observed were between legitimate customers. However, worldwide fraud networks have recently shifted to using CS:GO keys to liquidate their gains. At this point, nearly all key purchases that end up being traded or sold on the marketplace are believed to be fraud-sourced.\"\n\nRegulatory Context: This confession followed the Washington State Gambling Commission (WSGC) formal ultimatum to Valve and the July 2016 Cease & Desist orders issued by Valve General Counsel Karl Quackenbush to 23 skin-gambling domains (including CSGO Lotto, CSGOLounge, and OPSkins) only after criminal gambling scrutiny threatened platform operations.\n\nJurisdiction\nA rights-holder in Russia, unreachable to the user\n\nThe Subscriber Agreement presents Valve as a party that owes little and can be reached by no one: locks are permanent, appeals are declined, and access is withdrawn from whole territories on a single line about \"sanctioned regions.\" Set against that posture is what Valve does when its own commercial interests are the thing at stake in a jurisdiction it otherwise treats as difficult.\n\nValve v. Touch Skins — pre-trial IP claim, Russia\n1 Sep 2026\nValve, through the Russian law firm Melling, Voitishkin & Partners, sends a pre-trial demand letter to the operators of Touch Skins, a large CS2 skin-changer, by Russian Post and email.\nGrounds\nThree groups of alleged violations: exclusive rights to the software; rights to the appearance of weapon, knife and glove skins; and Valve's trademarks. The operators' conduct is characterised as deliberate and prolonged.\nDemand\nImmediately cease operation and delete all infrastructure — the software's source code, websites and social-media pages — failing which Valve reserves the right to sue in a Russian court for significant monetary compensation and to refer the matter to law-enforcement for a criminal assessment.\nOutcome\nAfter receiving the letter, the platform announced it was shutting down. Reported as Valve's first use of legal tooling against a skin-changer developer in Russia.\n\nReported by data-miner Maxim \"GabeFollower\" Poletaev (X, ~11 Sep 2026) and Russian gaming press. This is a pre-trial claim, not a filed suit; no docket number is public. Treated here as reported, not as a court record. Sources: dota2.ru archived 2026-09-24 ↗ · Shazoo.\n\nThe same jurisdiction, the other direction\n\nValve is not a stranger to the Russian legal and regulatory system. It complies with Roskomnadzor: on the regulator's demand it removed 260+ Steam community pages carrying prohibited material, and Roskomnadzor has publicly stated that Steam meets the legislation's requirements. Russia's \"landing\" law (Federal Law 236-FZ, in force from 2022) requires large foreign internet platforms serving Russian users to establish a local presence and a Roskomnadzor liaison account. Valve both answers that regulator's takedown orders and, now, wields Russian counsel and the threat of Russian courts to protect its skins as intellectual property.\n\nSo the platform is reachable, capable and rights-asserting exactly where its revenue is concerned. The contrast is with the user: a paying customer in a sanctioned region is told the relationship is over, the community access is locked until 2038, the ticket is closed, and no forum exists in which the decision can be tested — \"they were more than happy to take my money and process my transactions\", the same account's refund from the same Iranian IP having been approved a year earlier (r/pcgaming, 4 Aug 2026; more enforcement letters in the card-economy exhibit). Valve deploys the full apparatus of a national legal system to defend a skin; it affords the user who bought skins no process at all.\n\nValve treats the same jurisdiction as one it can act within, and comply within, whenever the interest at stake is Valve's — Russian counsel, the threat of Russian courts, Roskomnadzor takedown orders answered — while treating its obligations to the users of that market, and of every other, as beyond any process at all. It is a rights-holder where its revenue is concerned and an unreachable party where the user's rights would be.\n\nSources: TASS (RKN: Steam complies) · Federal Law 236-FZ.\n\nLegal opportunism\nThe Arbitration Clause Capitulation\n2023 — the attack\n\nLaw firms (Zaiger LLC, Mason LLP) recruited thousands of users via social media and filed tens of thousands of individual arbitration claims simultaneously.\n\nValve's exposure\n\n$225M+\nin non-refundable arbitration filing fees, before any case was heard on the merits. Calculated under American Arbitration Association (AAA) Consumer Arbitration Rules and Mass Arbitration Supplementary Schedules. Claimants represented by Zaiger LLC and Mason LLP filed ~75,000 individual arbitration demands against Valve Corp. (parallel to antitrust claims in Wolfire Games LLC et al. v. Valve Corp., Case No. 2:21-cv-00563-JCC, W.D. Wash.). Under AAA consumer fee schedules, the business respondent pays non-refundable administrative case fees and arbitrator appointment deposits of ~$3,000+ per individual case (75,000 filings × $3,000 = ~$225M in upfront procedural liabilities). See Bloomberg Law and Reuters legal reports on tech mass arbitration exposure (2023–2024).\n\nPeriod\tSSA dispute mechanism\tObserved effect\tResult\nBefore Sep 2024\tMandatory individual arbitration + class-action waiver\tIndividual litigation becomes economically irrational for users\tMass arbitration → $225M fee threat\nAfter Sep 2024\tDisputes in King County, WA courts only\tArbitration costs are avoided; cases consolidate in a single forum\tClass actions now possible\nConclusion\n\nFor over ten years the SSA required users to waive their right to a jury trial in favour of individual arbitration. After the mass-arbitration filings made that mechanism financially costly to Valve, the SSA was amended to route disputes to King County courts. The change was presented without a meaningful opt-out; the alternative to acceptance was losing access to purchased digital assets by deleting the account.\n\nAlgorithmic enforcement\nVACNet, Presumption of Guilt, and False Positives\nOctober 2023 — AMD Anti-Lag+\n\nAn AMD driver update (v23.10.1) activated Anti-Lag+ in CS2, which intercepted game DLL functions. VAC classified this as cheat-code injection and issued permanent bans to thousands of legitimate users before Valve intervened.\n\nDecember 2023 — high DPI\n\nPlayers with DPI above 10,000 rapidly turning the camera received permanent bans. VACNet could not distinguish physical mouse movement from a \"spinbot\" cheat.\n\nSupport category\tClaimed response time\tActual outcome\nRefund requests\t50 min – 1.5 hr\tAutomatic approval (<14 days, <2 hours played)\nAccount security / recovery\t3–12 hours\tDepends on documentation provided\nContesting a VAC ban\tForm response\tComplete refusal. Support cannot reverse VAC decisions. The ban is permanent.\nOfficial Valve policy\n\n\"VAC bans are permanent, non-negotiable, and cannot be removed by Steam Support.\"\n\nThe same support channel that carries the ban also carries the refusal of review: Steam Support states it cannot reverse a VAC decision. For the user, the algorithm's verdict is the operative outcome.\n\nEconomics of resale\nControl over virtual assets and the resale fee\nThe 15% CS2 market fee — value removed on each resale\nIteration\tBuyer's balance\tSeller receives\tBurned (15%)\n1\t$100.00\t$85.00\t$15.00\n2\t$85.00\t$72.25\t$12.75\n3\t$72.25\t$61.41\t$10.84\n10\t$23.16\t$19.68\t~$3.47\nTotal\t$100 → dust\tValve collects the 15% fee on each resale. Users must add new money to keep trading.\nCS2 trade-up rule change — October 2025\n\nWithout advance notice, Valve altered CS2 trade-up contract rules to allow guaranteed acquisition of rare knives and gloves in exchange for Covert-quality items. Knife prices fell, Covert item prices rose sharply, and panic selling followed across the market.\n\nValve's stated protection is Section 7 of the SSA — no liability for changing platform rules. Users bear the risk in an economy whose rules Valve can change without notice or compensation. The size of the reported market-wide loss is disputed and is not stated here without a primary source.\n\nEuropean regulatory response\nUOKiK, DSA, and the Digital Fairness Act\nUOKiK — Poland, May 2024\n\nPoland's antitrust authority (UOKiK) launched formal antimonopoly proceedings against Valve Corporation and five domestic game publishers/distributors regarding alleged price-fixing, restrictive price-parity clauses, and geo-blocking practices that caused Polish consumers to pay up to 20% more for digital games than neighboring EEA markets. As part of the antitrust inquiry, UOKiK inspectors and police conducted dawn raids and evidence inspections at the Polish premises of domestic partner publishers and distributors (not Valve subsidiary offices, as Valve maintains no Polish entity). Potential statutory fine: up to 10% of annual turnover. Source: UOKiK official announcement, \"Prezes UOKiK wszczął postępowanie przeciwko Valve i twórcom gier\", May 2024.\n\nDigital Services Act (DSA)\n\nRequires transparency in automated moderation. Steam publishes no false-positive/false-negative data for VACNet, and its support channel states that VAC decisions cannot be reversed.\n\nDigital Fairness Act — 2026\n\nExpected provisions: durable access to paid content, prohibition of dark patterns at the point of rights-waiver, recognition of property rights in digital assets, and protection from permanent inventory confiscation.\n\nConclusion\nDocumented gaps between the rules and the record\n1\n\nThe ownership gap. Users pay full price for a licence that the agreement allows Valve to revoke. The French Supreme Court (Oct 2024) held that digital resale is not protected, fixing that position in law.\n\n2\n\nAlgorithmic enforcement. VACNet issued false bans (AMD drivers, high-DPI incidents). Steam Support states it cannot reverse a VAC decision, so the algorithm is the operative final word.\n\n3\n\nEconomy of fees. The 15% CS2 market fee (5% Steam + 10% publisher fee) removes value on every resale, and platform rules can change without notice; Valve's liability for such changes is disclaimed under the SSA.\n\n4\n\nArbitration clause removed. The SSA dropped mandatory arbitration in September 2024, after mass filings exposed Valve to ~$225M in fees. Users received no meaningful opt-out from the change.\n\n5\n\nSelective jurisdiction. Valve engaged Russian counsel (Melling, Voitishkin & Partners) and threatened Russian court proceedings against Touch Skins, while simultaneously treating its obligations to users of that same market as beyond any adjudicative process. Valve acts as a rights-holder where its commercial interests are engaged, and as an unreachable party where the user's rights would be.\n\n← Part I: Proxy bypass & gamblingPart II: Access & accountability →\n\nLegal sources and case records are cited to their original publishers and repositories. No ownership of the underlying documents is claimed.",
        "headings": [
          {
            "level": 1,
            "id": null,
            "text": "Legal Analysis — Terms of Service & Regulatory Compliance"
          },
          {
            "level": 2,
            "id": null,
            "text": "Liability waiver and the revocable licence"
          },
          {
            "level": 3,
            "id": null,
            "text": "2.1 The \"subscription\" model vs. property rights"
          },
          {
            "level": 3,
            "id": null,
            "text": "2.2 The refund illusion vs. the EU Consumer Rights Directive"
          },
          {
            "level": 2,
            "id": null,
            "text": "Secondary Market and Antitrust"
          },
          {
            "level": 3,
            "id": null,
            "text": "UFC Que Choisir v. Valve — France"
          },
          {
            "level": 3,
            "id": null,
            "text": "Wolfire Games antitrust — United States (In re Valve Antitrust Litigation, No. 2:21-cv-00563)"
          },
          {
            "level": 3,
            "id": null,
            "text": "Valve Official Confession: Worldwide Fraud Liquidations (28 October 2019)"
          },
          {
            "level": 2,
            "id": null,
            "text": "A rights-holder in Russia, unreachable to the user"
          },
          {
            "level": 3,
            "id": null,
            "text": "Valve v. Touch Skins — pre-trial IP claim, Russia"
          },
          {
            "level": 3,
            "id": null,
            "text": "The same jurisdiction, the other direction"
          },
          {
            "level": 2,
            "id": null,
            "text": "The Arbitration Clause Capitulation"
          },
          {
            "level": 2,
            "id": null,
            "text": "VACNet, Presumption of Guilt, and False Positives"
          },
          {
            "level": 2,
            "id": null,
            "text": "Control over virtual assets and the resale fee"
          },
          {
            "level": 3,
            "id": null,
            "text": "The 15% CS2 market fee — value removed on each resale"
          },
          {
            "level": 3,
            "id": null,
            "text": "CS2 trade-up rule change — October 2025"
          },
          {
            "level": 2,
            "id": null,
            "text": "UOKiK, DSA, and the Digital Fairness Act"
          },
          {
            "level": 2,
            "id": null,
            "text": "Documented gaps between the rules and the record"
          }
        ],
        "links": [
          "https://phishdestroy.io/steam_dossier/de/legal_analysis.html",
          "https://phishdestroy.io/steam_dossier/de/#briefing-heading",
          "https://dota2.ru/news/67707-valve-cerez-uristov-napravila-krupnoj-rossijskoj-skincendzer-platforme-trebovanie-o-prekrasenii-deatelnosti/",
          "http://web.archive.org/web/20260924181657/https://dota2.ru/news/67707-valve-cerez-uristov-napravila-krupnoj-rossijskoj-skincendzer-platforme-trebovanie-o-prekrasenii-deatelnosti/",
          "https://shazoo.ru/2026/09/12/190508/valve-cerez-rossiiskix-iuristov-dobilas-zakrytiia-krupnogo-skinceindzera-dlia-cs2",
          "https://www.reddit.com/r/pcgaming/comments/1vf24lu/warning_to_all_gamersexpats_steam_took_my_money/",
          "https://phishdestroy.io/steam_dossier/de/card_economy.html#asymmetry",
          "https://tass.ru/obschestvo/23235387",
          "https://base.garant.ru/401414628/",
          "https://uokik.gov.pl/postepowanie-wyjasniajace-w-sprawie-valve-i-dystrybutorow-gier",
          "https://phishdestroy.io/steam_dossier/de/",
          "https://phishdestroy.io/steam_dossier/de/investigation_part2.html"
        ]
      },
      "source_json": "legal_analysis.content.json",
      "source_json_sha256": "ca9c7569b13c95b88abfae90828ddcfa4637c78894a69fcf23f475139284d70a"
    },
    {
      "source": "https://phishdestroy.io/steam_dossier/security_timeline",
      "language": "en",
      "title": "Security Timeline — The Steam Dossier",
      "start_page": 175,
      "end_page": 180,
      "editorial_scope": {
        "policy": "Research prose, conclusions, methodological limits and analytical tables retained without paragraph truncation. Named catalogues and visual galleries are linked; raster images are not embedded.",
        "linked_sections": [],
        "raster_images_replaced": 0
      },
      "content": {
        "text": "Dieses Material ist auf Englisch verfügbar.Zurück zum Dossier · Deutsch ↗\nTHE SECURITY RECORDEXHIBIT / 16 ENTRIES\n\n2018 — 2026\n\nSecurity Timeline — 2018 to 2026\n\nSecurity changed. Follow the record.\n\nWHAT THIS SECTION PROVES\n\nThis chronological record reconstructs eight years of security modifications across Steam's trade and authentication stack. It tracks the 2018 7-day trade hold implementation, 2023 Web API key mobile confirmations, and the 2026 session token deprecations against documented bypass techniques. The timeline establishes that platform updates consistently lagged known exploit vectors while preserving structural advantages for commercial operators.\n\n← Back to Executive briefing\n\nTrade locks. Login controls. API restrictions. A dated record of what changed—and what the sources actually establish.\n\nExplore the timeline ↓\nEIGHT YEARS. ONE RECORD.16milestones to examine\n\nEvery entry keeps its submitted date and source. Verification is shown alongside it.\n\nREVIEWED / 24 SEP 2026\n10Verified event & date\n06Partly verified\n00Source mismatch\n00Source needed\nHow to read this record\n\nVerified event & date: both supported by a readable primary source. Partly verified: a related change is documented, but the date or scope remains unresolved. Source mismatch: the linked material does not support the submitted claim. Source needed: no matching dated source was verified in this review. An unresolved entry is not proof that an event did not happen.\n\nDates on unresolved entries are submitted dates, not verified release dates. The original investigation text has not been rewritten.\n\nThe chronology\n01 — 16\nSearch the recordTopicEvidenceOrder\n\n16 of 16 entries · newest first\n\n202609-01Submitted date\nCommunityPartly verified\nSuspicious-message warnings in group chats\n\nAn official beta notice confirms the feature on 31 August. The supplied 1 September stable-release date still needs its specific release note.\n\nSteam Client Beta — August 31st ↗archived 2026-03-13 ↗\nOriginal entry & submitted link\n\nAutomated Suspicious Chat Flagging\n\nInspect the submitted source ↗\n202601-16Verified date\nAPIVerified event & date\nGranular permissions & IP whitelisting for Publisher Keys (Valve announcement)\n\nOn 16 January 2026, Valve published an official Steamworks announcement (\"NEW: Better permissions and controls for Web API Keys\") confirming new granular permission tools allowing developers to segment Web API keys into discrete groups (General, Microtransactions, Economy, and Sales Data), restrict keys to specific App IDs, and enforce server IP whitelisting.\n\nThe Glaring Double Standard: This official announcement establishes that Valve has fully developed the technical infrastructure for granular API permissions and IP restrictions, but deliberately withholds them from regular user accounts (steamcommunity.com/dev/apikey). Regular user API keys remain monolithic, all-or-nothing credentials with no IP whitelisting—which is the exact technical omission enabling the multi-million-dollar API trade interception industry.\n\nValve Announcement — NEW: Better permissions and controls for Web API Keys (16 Jan 2026) ↗· Documentation: Steamworks Web API Authentication ↗\nOriginal entry & submitted link\n\nSteamworks Web API Granular Scopes\n\nInspect Valve's Official Steamworks Announcement (493839547938902179) ↗\n202507-15Verified date\nTradingVerified event & date\nCS2 trades gain a seven-day reversal window\n\nValve's dated announcement introduces reversal of Counter-Strike item trades from the preceding seven days. While designed to mitigate hijacking, third-party economic audits (CSMarketCap ↗) recorded a $104M (-25%) collapse in market capitalization within 24 hours due to cash-trading disruption. As analyzed by Skinvault ↗, triggering a reversal inflicts an automatic 30-day trade lockout on the account. In summer 2026, Valve shifted from global midnight UTC resets to individual per-item minute timers (Skin.land ↗).\n\nValve — 15 July 2025 announcement ↗· CSMarketCap Analysis ↗\nOriginal entry & submitted link\n\nCS2 Trade Protection / Reversal Window\n\nInspect the submitted source ↗\n202505-14Verified date\nAuthenticationVerified event & date\nValve publishes account security warning regarding SMS leaks\n\nValve's official announcement on May 14, 2025, addresses account security and SMS-based authenticators. While the notice focuses on SMS leaks and confirms no Steam systems were breached, it serves as an official security update on the submitted date.\n\nValve — A note about the security of your Steam account ↗\nOriginal entry & submitted link\n\nAccount Security Announcement\n\nInspect the submitted source ↗\n202410-02Verified date\nTradingVerified event & date\nSeven days before re-trading or re-marketing\n\nThe release notes cover items acquired through the in-game store, including the Armory, trade offers and the Community Market. The documented scope is wider than Armory items alone.\n\nValve — Release Notes for 10/2/2024 ↗\nOriginal entry & submitted link\n\nCS2 The Armory / 7-Day Hold\n\nInspect the submitted source ↗\n202409-18Submitted date\nTradingPartly verified\nNew-device restrictions verified on Help Pages\n\nSteam's official support documentation confirms a 7-day trading restriction when logging in from a new device that has not been authorized for at least 7 days. While the exact rollout date of September 18, 2024, is not recorded as a changelog milestone, the functionality is fully documented.\n\nSteam Support — Trading and Market Restrictions ↗\nOriginal entry & submitted link\n\nNew Device Login Trade Restriction\n\nInspect the submitted source ↗\n202402-14Submitted date\nCommunityPartly verified\nName-change trade cooldown implemented in 2024\n\nCommunity and developer records confirm that in early 2024, Valve introduced an unannounced 2-to-4 hour trade cooldown immediately following a profile name change to mitigate rapid impersonation scams. Because Valve published no official press release, client changelog, or support article for this restriction, the submitted February 14 date lacks formal verification; the Steam Workshop guide serves as indirect community corroboration rather than official Valve documentation.\n\nSteam Workshop Guide (indirect corroboration) — Name-change restriction detail ↗\nOriginal entry & submitted link\n\nProfile Name / Avatar Change Hold\n\nInspect the submitted source ↗\n202312-04Verified date\nAPIVerified event & date\nKey creation requires mobile confirmation\n\nThe introduction of mandatory Steam Guard mobile confirmation for Web API key creation is verified to have occurred in late 2023, as documented by third-party developer libraries. The exact date of December 4, 2023, represents the observed rollout period within the developer community.\n\nMaintainer documentation — March 2024 ↗archived 2026-09-24 ↗\nOriginal entry & submitted link\n\nMobile Confirmation for API Keys\n\nInspect the submitted source ↗\n202310-24Verified date\nDeveloperVerified event & date\nMandatory 2FA for setting game builds live goes effective\n\nValve's official Steamworks announcement on October 10, 2023, confirms that starting October 24, 2023, any account setting a build live on the default branch of a released application must authorize the change via SMS or the Steam Mobile App. This change directly updated the SetAppBuildLive Web API.\n\nSteamworks — Security improvements for managing builds and users ↗archived 2025-12-03 ↗\nOriginal entry & submitted link\n\nSMS MFA for Game Build Publications\n\nInspect the submitted source ↗\n202307-12Submitted date\nCommunityPartly verified\nCustom biography content warnings observed by community\n\nSteam community reports starting in July 2023 document that custom profile biographies containing external links or trigger words began displaying automated content warnings. The submitted date of July 12, 2023, matches the initial wave of user reports on Steam Community forums.\n\nSteam Community Forum — Bio Content Warning Reports ↗\nOriginal entry & submitted link\n\nCustom Biography Content Warning\n\nInspect the submitted source ↗\n202301-25Submitted date\nCommunityPartly verified\nProfile link filtering and editing cooldowns active\n\nSteam's official support documentation confirms that links in custom biographies are filtered, and abusive name or avatar changes can trigger editing bans. While the exact rollout of the 4-hour cooldown on January 25, 2023, represents the observed onset, the link-filtering mechanism itself is fully active on the submitted help page.\n\nSteam Support — Profile Name and Avatar Restrictions ↗\nOriginal entry & submitted link\n\nProfile LINK REMOVED / Cooldown\n\nInspect the submitted source ↗\n202210-24Verified date\nAuthenticationVerified event & date\nSteam Client transition to OAuth refresh and access tokens\n\nValve's major client and mobile app updates in October 2022 overhauled the Steam authentication system. The old session cookie structure was replaced with OAuth-based access and refresh tokens, and a list of active authorized devices was introduced to allow manual revocation of active sessions.\n\nValve — Steam Mobile App Update and Authentication Overhaul ↗\nOriginal entry & submitted link\n\nSteam Login Overhaul / Cookie Truncation\n\nInspect Valve Announcement ↗\n202210-12Verified date\nAuthenticationVerified event & date\nQR sign-in and authorized-device management\n\nValve's 12 October announcement describes QR sign-in, approval or denial of sign-ins, and a device list that can revoke account access.\n\nValve — The updated Steam Mobile App is now available ↗\nOriginal entry & submitted link\n\nSteam Mobile App 3.0 / QR Login\n\nInspect the submitted source ↗\n202205-10Submitted date\nAPIPartly verified\nTrade cancellation endpoints removed from public API list\n\nDeveloper records confirm that in May 2022, Valve silently removed trade management endpoints such as IEconService/CancelTradeOffer and DeclineTradeOffer from the Web API (documented in node-steam-tradeoffer-manager #325). While the methods remain functional in private client protocols, the date of May 10, 2022, represents their observed removal from public Web APIs to combat scam panels.\n\nDeveloper Discussion — Issue #325 (CancelTradeOffer removed) ↗· Steamworks Web API — IEconService Documentation ↗\nOriginal entry & submitted link\n\nRemoval of Trade Cancellation Endpoints\n\nInspect node-steam-tradeoffer-manager Issue #325 ↗\n202005-25Verified date\nTradingVerified event & date\nDota 2 items receive a seven-day trading cooldown\n\nOn May 25, 2020, alongside the International 10 Battle Pass release (blog.dota2.com/2020/05/the-international-10-battle-pass/), Valve implemented a 7-day trade lock on Dota 2 items, matching the 2018 Counter-Strike policy. This restriction applies to all traded items and Market purchases.\n\nDota 2 Community — Trade Lock and TI10 Client Update ↗\nOriginal entry & submitted link\n\nDota 2 / 7-Day Trade Lock\n\nInspect the submitted source ↗\n201803-29Verified date\nTradingVerified event & date\nTraded CS:GO items receive a seven-day cooldown\n\nThe official release notes confirm the date and restriction. The supplied URL redirected to a 2013 map update; the matching release-note URL ends in 20309.\n\nValve — Release Notes for 3/29/2018 ↗\nOriginal entry & submitted link\n\nCS:GO / 7-Day Trade Lock\n\nInspect the submitted source ↗ archived 2025-02-26 ↗\n\nFollow the evidence. Inspect the source.\n\nReturn to the investigation ↗",
        "headings": [
          {
            "level": 1,
            "id": null,
            "text": "Security Timeline — 2018 to 2026"
          },
          {
            "level": 2,
            "id": null,
            "text": "The chronology"
          },
          {
            "level": 2,
            "id": null,
            "text": "Suspicious-message warnings in group chats"
          },
          {
            "level": 2,
            "id": null,
            "text": "Granular permissions & IP whitelisting for Publisher Keys (Valve announcement)"
          },
          {
            "level": 2,
            "id": null,
            "text": "CS2 trades gain a seven-day reversal window"
          },
          {
            "level": 2,
            "id": null,
            "text": "Valve publishes account security warning regarding SMS leaks"
          },
          {
            "level": 2,
            "id": null,
            "text": "Seven days before re-trading or re-marketing"
          },
          {
            "level": 2,
            "id": null,
            "text": "New-device restrictions verified on Help Pages"
          },
          {
            "level": 2,
            "id": null,
            "text": "Name-change trade cooldown implemented in 2024"
          },
          {
            "level": 2,
            "id": null,
            "text": "Key creation requires mobile confirmation"
          },
          {
            "level": 2,
            "id": null,
            "text": "Mandatory 2FA for setting game builds live goes effective"
          },
          {
            "level": 2,
            "id": null,
            "text": "Custom biography content warnings observed by community"
          },
          {
            "level": 2,
            "id": null,
            "text": "Profile link filtering and editing cooldowns active"
          },
          {
            "level": 2,
            "id": null,
            "text": "Steam Client transition to OAuth refresh and access tokens"
          },
          {
            "level": 2,
            "id": null,
            "text": "QR sign-in and authorized-device management"
          },
          {
            "level": 2,
            "id": null,
            "text": "Trade cancellation endpoints removed from public API list"
          },
          {
            "level": 2,
            "id": null,
            "text": "Dota 2 items receive a seven-day trading cooldown"
          },
          {
            "level": 2,
            "id": null,
            "text": "Traded CS:GO items receive a seven-day cooldown"
          }
        ],
        "links": [
          "https://phishdestroy.io/steam_dossier/de/security_timeline.html",
          "https://phishdestroy.io/steam_dossier/de/#briefing-heading",
          "https://steamcommunity.com/groups/SteamClientBeta?l=english",
          "http://web.archive.org/web/20260313235409/https://steamcommunity.com/groups/SteamClientBeta?l=english",
          "https://store.steampowered.com/news/posts/?enddate=1788390000",
          "https://steamcommunity.com/groups/steamworks/announcements/detail/493839547938902179",
          "https://partner.steamgames.com/doc/webapi_overview/auth",
          "https://csmarketcap.com/blog/market-insights/from-boom-to-bust-cs2s-trade-protection-impact",
          "https://skinvault.gg/blog/cs2-trade-protection-explained/",
          "https://skin.land/blog/steam-changes-cs2-trade-ban-logic-timing/",
          "https://store.steampowered.com/news/posts/?appids=730&enddate=1753924057&feed=steam_announce%2F1000",
          "https://help.steampowered.com/faqs/view/3041-A87A-E5F6-B6AC",
          "https://store.steampowered.com/news/posts/?enddate=1747349559",
          "https://steamcommunity.com/ogg/593110/announcements/detail/533224478739530146",
          "https://store.steampowered.com/news/posts/?appids=730&enddate=1728000977&feed=steam_community_announcements",
          "https://steamcommunity.com/games/CSGO/announcements/detail/4447966961421256740",
          "https://help.steampowered.com/faqs/view/7F77-9E92-31E0-6B8E",
          "https://steamcommunity.com/sharedfiles/filedetails/?id=2926756889",
          "https://github.com/DoctorMcKay/node-steam-tradeoffer-manager/wiki/Access-Tokens",
          "http://web.archive.org/web/20260924181824/https://github.com/DoctorMcKay/node-steam-tradeoffer-manager/wiki/Access-Tokens",
          "https://steamcommunity.com/dev/apikey",
          "https://steamcommunity.com/groups/steamworks/announcements/detail/3749866608167579206",
          "http://web.archive.org/web/20251203174259/https://steamcommunity.com/groups/steamworks/announcements/detail/3749866608167579206",
          "https://steamcommunity.com/groups/steamworks/announcements/detail/3734103130194459461",
          "https://steamcommunity.com/discussions/forum/1/3807266184852932971/",
          "https://help.steampowered.com/faqs/view/225C-C51E-B8F0-55B2",
          "https://store.steampowered.com/news/group/4/view/3314112260640237775",
          "https://store.steampowered.com/news/posts/?appgroupname=Keep+in+touch&enddate=1666122699&feed=steam_blog",
          "https://github.com/DoctorMcKay/node-steam-tradeoffer-manager/issues/325",
          "https://partner.steamgames.com/doc/webapi/IEconService",
          "https://steamcommunity.com/app/570/announcements/",
          "https://blog.dota2.com/2020/05/trading-cooldown/",
          "https://blog.counter-strike.net/2018/03/20309/",
          "https://blog.counter-strike.net/index.php/2018/03/20308/",
          "http://web.archive.org/web/20250226114333/https://blog.counter-strike.net/index.php/2018/03/20308/",
          "https://phishdestroy.io/steam_dossier/de/#vulnerability-profile"
        ]
      },
      "source_json": "security_timeline.content.json",
      "source_json_sha256": "986bf1d6b910c1f155b030f633e6ae9950aa38752552d0bd297239fa5c49dc89"
    },
    {
      "source": "https://phishdestroy.io/steam_dossier/license_disclaimer",
      "language": "en",
      "title": "License · Rights · Disclaimer — PhishDestroy",
      "start_page": 181,
      "end_page": 190,
      "editorial_scope": {
        "policy": "Research prose, conclusions, methodological limits and analytical tables retained without paragraph truncation. Named catalogues and visual galleries are linked; raster images are not embedded.",
        "linked_sections": [],
        "raster_images_replaced": 0
      },
      "content": {
        "text": "Dieses Material ist auf Englisch verfügbar.Zurück zum Dossier · Deutsch ↗\nPHISHDESTROYForensic investigation · Valve / Steam\nLicense · Rights · Disclaimer\nLicense & Legal Disclaimer — Public Domain Dedication\n\nAll rights surrendered to humanity.\n\nWHAT THIS SECTION PROVES\n\nThis instrument establishes the unconditional public domain dedication (CC0 1.0 Universal) and MIT software licensing terms governing the PhishDestroy Steam Dossier. All forensic findings, evidentiary datasets, network graphs, and analytical methodologies are placed irrevocably in the public domain for unrestricted regulatory, legal, and academic use worldwide.\n\n← Back to Executive briefing\n\nPhishDestroy gives up every right to this material — reproduce it, sell it, put your name on it. What follows is two documents in one voice's clothing: an open letter to Valve, written the way we actually write, and a formal waiver written for the authority that will carry the substance forward.\n\nInvestigation · Valve Corporation / SteamPublic edition — no expiry, no take-backs\nWAIVED\nSection ILicense — the actual legal part, but human\n\nPhishDestroy gives up every right to this material. Zero. Gone. Done. You can reproduce it, sell it, put your name on it, tattoo it on your boss, whatever. No credit required, no DM needed, no thank-you card expected.\n\nOne actual rule (yes, just one)\n\nYOU do NOT get to decide whether you're a terrorist.\n\nIf you are a user from Russia or any OFAC-sanctioned country — this material is NOT for you. No loopholes. Enjoy your sanctions.\n\nAnd if you switched your Steam region to Turkey while sitting in Moscow — congratulations on your creative geography. You're still Russian. The sanctions still apply. That's literally the point.\n\nSection IIWhat this is and why it exists\n\nWe will publish more about Valve than an average Valve employee knows about themselves. That's not a brag. That's just where we ended up.\n\nHow did we get here? Funny story: Steam basically created us. It raised us on its scammers, its support tickets, its ban evasion ecosystem — and now here we are. No hard feelings. Poetic, actually.\n\nFor those who haven't read the origin story yet — we already met Valve's extremely expensive European lawyers (Taylor Wessing, since you asked):\n\nhttps://phishdestroy.medium.com/my-dog-vs-elite-gdpr-lawyers-the-valve-data-breach-nobody-is-talking-about-f6f7683d813d archived 2026-08-21 ↗\n\nCharming encounter. Especially given their hourly rate.\n\nDid Valve know? Yes. Did Taylor Wessing know? Almost certainly yes. But when you're that rich, laws are more of a vibe than a requirement, right?\n\nThat's kind of the whole answer, actually.\n\nSteam spent years farming scammers. Not always intentionally — sometimes scammers just got Valve's fingerprints on them by association. We're not trying to be dramatic about it. We're trying to be precise. That's harder for us than being dramatic, to be honest — this is just how we write.\n\nIs this a conflict?\n— No.\n\nCan it be resolved?\n— Yes. But we're not signing any NDA and we're not playing bug bounty for pennies.\n\nWe waited over 4 years for them to fix the spoofing issue before we could write about it publicly. Because if we had written about it earlier, Steam would've put on its little victim face and screamed \"active threat!\" and offered us pocket change to sign a document that would've made us their legal property forever. No thanks.\n\n(Also: Valve itself violates NDA. Their own employees do. The ones near the top. But sure, let's talk about ours.)\n\nSection IIIOpen letter to Valve — seriously, read this\n\nValve: if you want this domain taken down, email us. Outside counsel is not needed for that conversation.\n\nFor the uninitiated: Dr. Patrick holds a Master of Laws in International Commercial Law from the University of Aberdeen and — wait for it — literally finished his doctoral dissertation in IT law. He recently made partner at Taylor Wessing, which is a firm whose entire business model is billing companies like Valve obscene amounts of money to drag things out until the other side runs out of money or patience.\n\nWe don't blame him. Rich guilty clients who pay by the hour — solid career move. We just don't think you should be funding it.\n\nThe deal (open offer, no lawyers needed)\n\nThe domain is the only thing Valve can realistically reach. The investigation, the referrals, and the allied resources are already in motion — they continue with or without the domain.\n\nIf you want the domain:\n\nLet your IT law professionals set a fair price.\n\n50% goes to the SEAL Foundation.\n\nWe kill the domain. No drama. No court. Done.\n\nThis is not a threat. It is a straightforward offer for the one thing that is actually within reach. You won't get it any other way — that's just the architecture of the situation.\n\nWill we \"damage\" Valve directly? Probably not in a way they'll feel fiscally. We're not delusional. But we will do it honestly, openly, without chasing clout — because we don't need clout. We need the world to see what was always publicly visible if you spent enough time looking.\n\nWe have 5 years of archives. What Valve's lawyers showed in discovery — the data that support agents can see, the fingerprints, the paper trail they literally handed us — is enough. We don't need to leak it raw.\n\nWho gets what\n\nRegulators get the originals.\n\nResearchers and journalists get redacted versions (victim reports, children's logins and Valve's charming support commentary removed for obvious reasons).\n\nMinors were among the affected accounts and were not notified. That finding sits in the regulator package with the victim reports and credentials removed, because it belongs in front of a data-protection authority rather than in an article.\n\nAlso, Valve — we want to make something clear before you decide how to play this: PhishDestroy is a community, not a person. You learned that when you addressed legal correspondence to the community without bothering to speak with the community — just milked it for data and banned the accounts.\n\nThe community has no conflict with Valve. We didn't go looking for this. The scammers you grew found us. We blocked them. And here we are.\n\nSection III-BThe allied resources — a note to Steam specifically\n\nWe want to be upfront about the amplification structure, because pretending it doesn't exist would be dishonest.\n\nPhishDestroy, as we understand the community situation, has at least two allied resources that will pick up this material and run with it.\n\nWhat that means in practice:\n\nThey work their own angles on overlapping subject matter.\n\nThey are independent — they don't take our direction, we don't take theirs. Same general topic, different methodology.\n\nThey will NOT be activating on Part 1. They're watching.\n\nIf Valve chooses not to take down the site:\n\nExpect them to surface after Part 2 or Part 3.\n\nThey'll take what's useful from our work, supplement it with their own, and publish under their own authorship.\n\nThis is exactly the kind of thing the license in Section 1 is built for: the material goes where it needs to go, gets supplemented, gets amplified — and neither we nor they owe each other attribution.\n\n(PS for lawyers wondering about liability chains: there are none. These resources don't receive our direction, our funding, or our data. They read what's public and draw their own conclusions. Just like you could.)\n\nWe're not saying this to intimidate. We're saying it so that whoever is strategising on Valve's side has accurate information about what the information environment actually looks like.\n\nOne resource that pulls our material and supplements it would be a story. Two resources doing it independently and reaching similar conclusions is a pattern. Patterns are what regulators notice.\n\nSection IVThe money, the bans, the whole circus\n\nHere's the thing about Steam banning gambling sites and scammers: it's not enforcement. It's revenue capture. Valve pockets the money, cleans its hands, then goes on stage and tells everyone a wholesome story about Pokémon cards and baseball.\n\nWhere support-side compromises are documented — including Valve's written admission in February 2023 taking responsibility for high-value accounts compromised through help requests, and contractor staff dismissals reported by Dexerto and Escorenews following the $320k insider trade (Part II §04 · Main Dossier §14.1) — they rest on published admissions and investigative reporting. Unsubstantiated rumors of support staff operating gambling side hustles or taking percentages to lift bans are unestablished on the public record and are excluded here.\n\nMeanwhile Valve killed the ability to properly track skins in 2017. They even discussed it on their own forums. Called it \"anti-gambling measures\" — while the skin gambling ecosystem continued to route billions through Steam's infrastructure for years after. Great branding.\n\nWe're going to prove that:\n\nSkins are more anonymous than Monero\n\nA Peruvian Cartel allegedly used Dota 2 skins for money movement\n\nSteam is functionally a sanctions-bypass machine worth ~$7B in \"trading cards\" (yes, they actually said trading cards to a prosecutor)\n\nWe've got a video on the skins thing. You'll see it.\n\nWe also know:\n\nReddit moderation is influenced by Valve\n\nThird-party Steam data infrastructure (such as steamid.uk) is operated by a private individual (msart) whose linked sibling ban-list project (steambans.com archive) is co-administered by a confirmed Valve community moderator (killahinstinct_) — leaving independent auditing of platform bans entirely inside Valve's orbit (see Card Economy §08)\n\nWhat they can't control, they ban\n\nValve: if you keep playing dumb — that's fine. Your safe harbour is noted. Google Analytics anonymises your users' IPs anyway. We see what gets deleted. We just can't prove it cheaply enough for your lawyers to care. Yet.\n\nSection VThe malware thing — yes, we're mentioning it\n\nLet's be brutally clear about the sequence of events, because it exposes exactly who you are.\n\nWe are NOT disclosing the vulnerability in the game publicly. We are NOT reporting it to Steam. The programme requires an NDA, and signing one would bar us from telling the affected users what happened to their accounts. Disclosure to the people who lost those accounts, and to regulators, is the point of this work; a confidentiality agreement is incompatible with it.\n\nHere's what actually happened: This vulnerability is practically an open secret in the right circles. We know for a fact that independent security researchers have already shoved the full exploit directly into Steam Support's face. That part is done. You have been officially warned through your own sterile channels.\n\nAnd what did Valve do? Absolutely nothing. Because for Valve, security does not equal profit — in fact, it's the exact opposite. Security is a cost center. Until a threat reaches critical mass and causes a catastrophic public PR meltdown, Valve does not treat it as urgent.\n\nSo what are we doing? We're telling the public it exists, because \"Valve knows about a systemic malware threat and actively chooses to do nothing\" is a critical data point for the regulators currently reading this.\n\nThe game is massive. We're not naming it here. But understand this:\n\nThis is NOT the trivial CS:GO script-kiddie garbage where a server asks you to \"install a driver\". This is catastrophic.\n\nThis is an Unturned-level nightmare: zero-click RCE on server connect. You join a server. You click nothing. You download nothing. The connection itself is the attack surface, and your machine is fully compromised. Let's be real here: dropping an RCE and bypassing local antiviruses by piggybacking on Valve's trusted digital certificates isn't even a novelty on Steam anymore. It is practically a built-in feature of your ecosystem.\n\nValve already knows this exists. But they rely on their favorite, cowardly legal loophole: because the game is technically developed by a third party, Valve washes its hands. They distribute the game, they process the payments, they host the infrastructure, but when a zero-click RCE threatens millions of their users, their stance is: \"Not our game, not our liability.\"\n\nWhen this inevitably blows up, the third-party developer will take the bullet, and Valve will walk away pretending to be the responsible platform that \"assisted\" with the resolution. Classic Valve cowardice. We've seen the playbook.\n\nWe are putting this on the record so that regulators, prosecutors, and journalists understand exactly how Valve handles active malware: by hiding behind third-party developers, deploying NDA gag orders, and leaving the players as sitting ducks.\n\nEnd of the open letterFormal register begins\nFormal register · for the authority\nDeclarationAs to use and rights\n\nPhishDestroy Project & Cybersecurity Coalition\n\nThis declaration accompanies every submission and every exhibit in this referral set. It is addressed to any authority, court, regulator, prosecutor, researcher, journalist or affected person into whose hands the material comes.\n\n1. There are no conditions on use\n\n1.1 All material produced by the Coalition in this referral — the statements of fact, the analysis, the exhibits it has authored, the tooling, and the findings — is released WITHOUT RESERVATION OF ANY RIGHTS.\n\n1.2 Anyone may, without asking and without notifying us:\n\nreproduce it, in whole or in part;\n\nadapt, edit, rewrite, restructure or correct it;\n\ntranslate it;\n\nexcerpt it without indicating that it has been excerpted;\n\nincorporate it into official documents, findings, decisions, pleadings, reports or press material;\n\npresent it as the recipient's own work or the recipient's own findings;\n\nuse it as raw material and discard the rest;\n\nand pass it on to anyone else on the same terms.\n\n1.3 ATTRIBUTION IS NOT REQUIRED AND IS NOT SOUGHT. The Coalition need not be named, cited, credited, thanked, consulted or informed. If material from this referral assists an authority and the Coalition is never mentioned, THAT IS A COMPLETELY SATISFACTORY OUTCOME and the Coalition states so in advance so that the question need not be raised.\n\n1.4 If, on the other hand, an authority finds it more convenient to cite the Coalition as a source, it is free to do so. The choice is entirely the recipient's and neither course carries any consequence.\n\n1.5 This is a WAIVER, not a licence offer. It requires no acceptance, imposes no obligation, and cannot be breached. Software published by the Coalition is separately released under the MIT licence; the research and findings are released into the public domain to the fullest extent permitted, and where a jurisdiction does not permit waiver, the Coalition grants an irrevocable, worldwide, royalty-free licence to the same effect.\n\n2. Why this matters practically, and not only as a courtesy\n\n2.1 An authority may reasonably hesitate to rely on material supplied by an outside party, for fear of appearing to act at that party's instance or of acquiring some entanglement with it.\n\n2.2 THERE IS NOTHING HERE TO BE ENTANGLED WITH. The Coalition asks for nothing, is owed nothing, retains nothing, and has no expectation of any kind. It cannot later assert a right, claim credit, complain of misuse, or object to how the material is characterised, because it has retained no basis on which to do so.\n\n2.3 An authority using this material is therefore not acting for the Coalition. It is using public information that happens to have been assembled by someone else.\n\n3. Everything is open already\n\n3.1 The Coalition's work is public by default:\n\nthe investigations are published openly at https://phishdestroy.io and are freely readable;\n\nthe tooling is published as open source under the MIT licence at https://github.com/phishdestroy archived 2026-09-11 ↗;\n\nthe methodology is set out in the referral itself, at Annex A section A.16D, including the weight and limitations of each source type;\n\nthe Coalition accepts no donations and has published that position since 2018.\n\n3.2 The only material NOT published is that which cannot lawfully or safely be published: personal data of victims and of third parties, and information that would expose a source to retaliation. That material is supplied to authorities in confidence and is identified in the schedules of evidence.\n\n3.3 The Coalition invites scrutiny of its own conduct on the same terms it invites scrutiny of anyone else's, and has volunteered its own data handling to the authorities concerned, including a request for a direction on disposal.\n\n4. Integrity of the evidence bundle\n\n4.1 Exhibits are supplied with the submission or, where marked, on request through a secure channel. They are not published at a public address and no such address should be inferred: material of this kind is provided to authorities directly.\n\n4.2 Each delivery is accompanied by a file SHA256SUMS listing a SHA-256 digest for every file supplied, together with a detached OpenPGP signature SHA256SUMS.asc.\n\n4.3 The signing key is published at https://phishdestroy.io/.well-known/pgp-key.txt and on keys.openpgp.org. Its fingerprint appears in the letterhead of every submission in this set.\n\n4.4 Any recipient may verify at any time that a file in their possession is the file that was sent, unaltered:\n\ngpg --verify SHA256SUMS.asc SHA256SUMS\n\nsha256sum -c SHA256SUMS\n\n4.5 The purpose is not formality. It is so that, if the accuracy or integrity of any exhibit is disputed at a later date, the question can be settled by computation rather than by argument.\n\n5. On register — why the waiver is functional and not merely generous\n\n5.1 The authority may encounter the Coalition's published investigations and find them blunt, adversarial and at times satirical. That impression is correct. The Coalition writes that way deliberately and does not apologise for it.\n\n5.2 IT ALSO RECOGNISES THAT THIS IS THE WRONG REGISTER FOR A REGULATORY OR JUDICIAL PROCEEDING. A serious matter should not be carried in the voice of a campaign. Findings put before an authority should be stated flatly, with their limitations admitted, and should not require the reader to discount for tone before reaching the substance.\n\n5.3 THAT IS PRECISELY WHY THE COALITION WAIVES AUTHORSHIP. The waiver at section 1 is the mechanism by which the substance can be separated from the register: the authority may take what is useful, restate it in its own voice, and discard every word of the Coalition's manner along with the Coalition's name. Nothing is lost by doing so, and the Coalition would prefer it.\n\n5.4 THE COALITION ALSO ASKS THAT THE REGISTER NOT BE MISTAKEN FOR THE METHOD. The published tone is combative; the underlying practice is not careless. Throughout this referral, inference is separated from observation, testimony is identified as testimony, sources are weighted and their weaknesses stated, figures are presented with their limitations, and points the Coalition cannot prove are put as questions for the authority rather than as assertions. Where the evidence cut against the Coalition's own position it has said so — see Annex A, paragraph 7, and section B.0 of the parallel referral.\n\n5.5 THE COALITION EXPLAINS THE CONNECTION BETWEEN ITS MANNER AND ITS FINANCES BECAUSE THE TWO ARE NOT SEPARABLE. It takes no money from anyone — no donations, no bounties, no clients, no sponsors. That refusal is what makes the bluntness possible: an organisation with revenue to protect must moderate what it says about the parties it depends on. Having nothing to protect, the Coalition has nothing to moderate.\n\nIt is also the reason the Coalition continues to exist. There is no other engine. The work is done because it is done; it stops when the people doing it stop.\n\n5.6 The authority need accept none of this. It is stated so that the tone of the Coalition's public work is not read as a measure of the care taken with the material now before it.\n\n6. What the Coalition is providing, in its own words\n\nInformation, research and observation.\n\nNothing is asserted as a finding that the Coalition has no standing to make. Where something is inferred, the referral says so. Where something rests on testimony, the referral says whose and with what limitation. Where the Coalition cannot answer a question, it says that too, and identifies who can.\n\nThe Coalition seeks no remedy, no payment, no acknowledgement and no outcome for itself or for any individual. It asks only that the questions set out in the referral be put to Valve Corporation by a body with the power to compel an answer.\n\nClosing noteTo whoever is carrying this forward\n\nWe want to thank whoever gets this material to where it needs to go. It's probably not going to be a quick trip. Valve has deep pockets and Taylor Wessing charges by the hour — that combination is specifically designed to make people like you give up before they reach the finish line.\n\nWe know what we're doing. We know who we're writing about. Valve built us — how could we not understand them?\n\nPhishDestroy has no conflict with Valve. We blocked the only scammer ring of that scale we've come across — we didn't go looking for a fight with Valve. It just turned out that every road led back to them. Not a conflict. Just topology.\n\nValve cannot resolve the PhishDestroy situation because there is nothing to resolve. We have no relationship. The data about their enrichment schemes and overflow profits is largely public — you just had to spend enough time to see it. Think of it as a success encyclopedia: \"How to Not Follow Sanctions So That Russian Hackers Can't Pirate Our Free Games (The Paid Ones They Won't Pirate Anyway).\" You get the vibe.\n\nWe don't need authorship.\n\nWe don't need attribution.\n\nWe don't need a win.\n\nWe need someone with actual authority to ask Valve the questions that are already sitting in this referral, with the power to require an answer.\n\nThat's it. That's the whole ask.\n\nCases will live at:\n\nhttps://steamdestroy.eth/\n\nhttps://steamdestroy.eth.limo (currently broken — will fix when needed)\n\nWe'll be at:\n\nhttps://phishdestroy.eth.limo/ archived 2026-06-27 ↗\n\nhttps://phishdestroy.eth/\n\nTwo signed objects · rights and published text\nSigned releaseWhat is signed, and what it covers\n\nThe rights grant and research text are separately signed JSON objects below. Each detached OpenPGP signature authenticates the exact bytes of the JSON named beside it. The rights statement grants permissions; the text snapshot identifies and contains the material being published.\n\n1. Rights statement — license-rights.json\n\nSigned object: the complete license-rights.json file, containing the public rights grant dated 28 September 2026. It grants permission to copy, publish, edit, translate, combine and commercialise authored dossier materials without attribution, notification or approval. This signature authenticates the rights statement; it does not authenticate the text of every webpage or PDF.\n\nThe original signed release is preserved unchanged. Its existing grant cannot be withdrawn or narrowed by changing the website, publishing another file or taking the site offline. Third-party materials retain their own rights.\n\nRights statement JSON ↗ · Signature of license-rights.json ↗ · SHA-256 of license-rights.json ↗\n\ngpg --verify license-rights.json.asc license-rights.json\nsha256sum -c license-rights.json.sha256\n2. Published text — dossier-text.json\n\nSigned object: the complete dossier-text.json file. It contains the actual readable text of the exported pages in documents[].content.text, with each page’s title, language, source URL, source HTML hash, headings and references. The documents list is the exact inventory covered by this snapshot; the language variants are listed separately. It is a text publication, not just a list of hashes.\n\nEvery entry identifies its lightweight page PDF by filename and SHA-256 in documents[].pdf. The JSON also identifies the original rights statement by URL and SHA-256, so the published text, its PDF and the applicable rights release can be matched without guessing. Linked external databases, image originals and pages absent from the inventory are not embedded in this text snapshot.\n\nFull signed text JSON ↗ · Signature of dossier-text.json ↗ · SHA-256 of dossier-text.json ↗\n\ngpg --verify dossier-text.json.asc dossier-text.json\nsha256sum -c dossier-text.json.sha256\n\nOn the dossier home page, the PDF and JSON buttons export the research bundle. On an inner page, they export that page in its published language. Each page JSON also has its own detached signature and SHA-256 file, named explicitly in its integrity object. To verify the associated PDF, calculate its SHA-256 and compare it with the pdf.sha256 value in the verified JSON. The PDF is bound by that digest; it does not carry a PDF-format digital signature.\n\n3. Printable research bundle — steam-dossier-{language}.content.json\n\nSigned object: the complete language-specific JSON file, including the bundled chapter text in documents[].content.text, chapter page ranges, source languages, the excluded-source inventory and the exact PDF digest in pdf.sha256. The five supplementary evidence archives remain linked online and are not bundled. Authored research text is retained; visual catalogues are replaced with source links.\n\nEnglish JSON ↗ · Detached OpenPGP signature ↗ · SHA-256 digest ↗\n\nDeutsch JSON ↗ · Detached OpenPGP signature ↗ · SHA-256 digest ↗\n\ngpg --verify steam-dossier-en.content.json.asc steam-dossier-en.content.json\nsha256sum -c steam-dossier-en.content.json.sha256\n\nPublic verification key ↗\n\nSigning fingerprint: 129F C7F3 9C40 C69D 2EF3 C329 BFCF 9E8D D295 EE01\n\ngpg --import pgp-key.txt\ngpg --fingerprint 129FC7F39C40C69D2EF3C329BFCF9E8DD295EE01\n\nCheck that the displayed fingerprint matches the one above, then verify the signature against the exact JSON filename. Editing a signed JSON changes the signed object and invalidates its original signature. A valid signature identifies the published bytes; it is not independent verification of the research findings.\n\nPhishDestroy — public investigation — all rights surrendered to humanity\n\nOFAC-region access: prohibited",
        "headings": [
          {
            "level": 1,
            "id": null,
            "text": "License & Legal Disclaimer — Public Domain Dedication"
          },
          {
            "level": 2,
            "id": null,
            "text": "Section ILicense — the actual legal part, but human"
          },
          {
            "level": 3,
            "id": null,
            "text": "One actual rule (yes, just one)"
          },
          {
            "level": 2,
            "id": null,
            "text": "Section IIWhat this is and why it exists"
          },
          {
            "level": 2,
            "id": null,
            "text": "Section IIIOpen letter to Valve — seriously, read this"
          },
          {
            "level": 3,
            "id": null,
            "text": "The deal (open offer, no lawyers needed)"
          },
          {
            "level": 2,
            "id": null,
            "text": "Section III-BThe allied resources — a note to Steam specifically"
          },
          {
            "level": 2,
            "id": null,
            "text": "Section IVThe money, the bans, the whole circus"
          },
          {
            "level": 2,
            "id": null,
            "text": "Section VThe malware thing — yes, we're mentioning it"
          },
          {
            "level": 2,
            "id": null,
            "text": "DeclarationAs to use and rights"
          },
          {
            "level": 3,
            "id": null,
            "text": "1. There are no conditions on use"
          },
          {
            "level": 3,
            "id": null,
            "text": "2. Why this matters practically, and not only as a courtesy"
          },
          {
            "level": 3,
            "id": null,
            "text": "3. Everything is open already"
          },
          {
            "level": 3,
            "id": null,
            "text": "4. Integrity of the evidence bundle"
          },
          {
            "level": 3,
            "id": null,
            "text": "5. On register — why the waiver is functional and not merely generous"
          },
          {
            "level": 3,
            "id": null,
            "text": "6. What the Coalition is providing, in its own words"
          },
          {
            "level": 2,
            "id": null,
            "text": "Closing noteTo whoever is carrying this forward"
          },
          {
            "level": 2,
            "id": null,
            "text": "Signed releaseWhat is signed, and what it covers"
          },
          {
            "level": 3,
            "id": null,
            "text": "1. Rights statement — license-rights.json"
          },
          {
            "level": 3,
            "id": null,
            "text": "2. Published text — dossier-text.json"
          },
          {
            "level": 3,
            "id": null,
            "text": "3. Printable research bundle — steam-dossier-{language}.content.json"
          }
        ],
        "links": [
          "https://phishdestroy.io/steam_dossier/de/license_disclaimer.html",
          "https://phishdestroy.io/steam_dossier/de/#briefing-heading",
          "https://phishdestroy.medium.com/my-dog-vs-elite-gdpr-lawyers-the-valve-data-breach-nobody-is-talking-about-f6f7683d813d",
          "http://web.archive.org/web/20260821155801/https://phishdestroy.medium.com/my-dog-vs-elite-gdpr-lawyers-the-valve-data-breach-nobody-is-talking-about-f6f7683d813d",
          "https://phishdestroy.io/steam_dossier/de/investigation_part2.html#outsourcing-case",
          "https://phishdestroy.io/steam_dossier/de/#theft-ledger",
          "https://steamid.uk/",
          "http://web.archive.org/web/20251203104928/https://steamcommunity.com/groups/steambans",
          "https://steamcommunity.com/id/killahinstinct_",
          "https://phishdestroy.io/steam_dossier/de/card_economy.html#governance",
          "https://phishdestroy.io/",
          "https://github.com/phishdestroy",
          "http://web.archive.org/web/20260911040557/https://github.com/PhishDestroy",
          "https://phishdestroy.io/.well-known/pgp-key.txt",
          "https://steamdestroy.eth/",
          "https://steamdestroy.eth.limo/",
          "https://phishdestroy.eth.limo/",
          "http://web.archive.org/web/20260627040219/https://phishdestroy.eth.limo/",
          "https://phishdestroy.eth/",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/license-rights.json",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/license-rights.json.asc",
          "https://phishdestroy.io/steam_dossier/steam_tos_assets/license-rights.json.sha256",
          "https://phishdestroy.io/steam_dossier/exports/dossier-text.json?v=print-20260928-v3",
          "https://phishdestroy.io/steam_dossier/exports/dossier-text.json.asc?v=print-20260928-v3",
          "https://phishdestroy.io/steam_dossier/exports/dossier-text.json.sha256?v=print-20260928-v3",
          "https://phishdestroy.io/steam_dossier/exports/steam-dossier-en.content.json?v=print-20260928-v3",
          "https://phishdestroy.io/steam_dossier/exports/steam-dossier-en.content.json.asc?v=print-20260928-v3",
          "https://phishdestroy.io/steam_dossier/exports/steam-dossier-en.content.json.sha256?v=print-20260928-v3",
          "https://phishdestroy.io/steam_dossier/exports/steam-dossier-de.content.json?v=print-20260928-v3",
          "https://phishdestroy.io/steam_dossier/exports/steam-dossier-de.content.json.asc?v=print-20260928-v3",
          "https://phishdestroy.io/steam_dossier/exports/steam-dossier-de.content.json.sha256?v=print-20260928-v3"
        ]
      },
      "source_json": "license_disclaimer.content.json",
      "source_json_sha256": "bd5fdb1a7f32d3c39ba3b6556c1afa5cb5de196950ebc07c3910c6792f106131"
    }
  ]
}