PHISHDESTROYForensic investigation · Valve / Steam
The Agent Protocol · Material registerFragment map — authors & signatures
The numbered points of the investigation, with one Agent assigned to each material. Open the original point or download its PDF, JSON and detached signature.
31 materials31 authors1 fact = 1 author
Material registerTitles, authors and signed files
31 materials · 31 distinct Agent pseudonyms. Each row links its source, PDF, signed JSON and detached signature. PhishDestroy publishes the investigation and signs file integrity.
31 materials
| Fragment title / ID | Author | Language | Files / signature |
|---|---|---|---|
| Case briefing and executive summarySection 1 · section-1Read this point in the dossier ↗ | Agent Austin | EN | PDFJSONPGP signature |
| Open letter to the Washington State Gambling CommissionSection 2 · section-2Read this point in the dossier ↗ | Agent Kal | EN | PDFJSONPGP signature |
| Separate-domain authentication hosts: the Link Filter evidenceSection 3 · section-3Read this point in the dossier ↗ | Agent Lynn | EN | PDFJSONPGP signature |
| Inside Steam, Valve's list is the only listSection 3.1 · section-3-1Read this point in the dossier ↗ | Agent June | EN | PDFJSONPGP signature |
| The Big Picture Trap: Multi-Year Longitudinal Phishing Audit (120 Domains)Section 3.2 · section-3-2Read this point in the dossier ↗ | Agent Ignatus | EN | PDFJSONPGP signature |
| The Asset ID blackout: the update that restricted public item tracingSection 4 · section-4Read this point in the dossier ↗ | Agent Gordon | EN | PDFJSONPGP signature |
| The vulnerability profile of the pre-2023 API-key architectureSection 5 · section-5Read this point in the dossier ↗ | Agent Sofia | EN | PDFJSONPGP signature |
| The standards were public and dated: Valve builds against them every daySection 5.1 · section-5-1Read this point in the dossier ↗ | Agent Lucia | EN | PDFJSONPGP signature |
| Interactive Exploit & Hijack SimulatorSection 6 · section-6Read this point in the dossier ↗ | Agent Carla | EN | PDFJSONPGP signature |
| Steam Web API endpoints used in the hijack patternSection 7 · section-7Read this point in the dossier ↗ | Agent Amy | EN | PDFJSONPGP signature |
| Machine-injected consentSection 8 · section-8Read this point in the dossier ↗ | Agent Aaron | EN | PDFJSONPGP signature |
| Forensic Autopsy: How Valve Killed Trade Substitution (And Left 3 Loopholes)Section 8.1 · section-8-1Read this point in the dossier ↗ | Agent Jasmine | EN | PDFJSONPGP signature |
| Selective enforcement: the rulebook against the recordSection 9 · section-9Read this point in the dossier ↗ | Agent Lorraine | EN | PDFJSONPGP signature |
| The Web API paradox: a rule against the automation Valve shipsSection 10 · section-10Read this point in the dossier ↗ | Agent Dylan | EN | PDFJSONPGP signature |
| The July 2016 notice and the Washington recordSection 11 · section-11Read this point in the dossier ↗ | Agent Mariana | EN | PDFJSONPGP signature |
| The 10-Day Notice Decade: Survival Audit of the 23 Named Sites & The Surviving TitansSection 11.1 · section-11-1Read this point in the dossier ↗ | Agent Constance | EN | PDFJSONPGP signature |
| Enforcement feasibility: domain-level blockingSection 12 · section-12Read this point in the dossier ↗ | Agent Randall | EN | PDFJSONPGP signature |
| The off-Steam price gapSection 13 · section-13Read this point in the dossier ↗ | Agent Neil | EN | PDFJSONPGP signature |
| Support access and the theft ledgerSection 14 · section-14Read this point in the dossier ↗ | Agent Tom | EN | PDFJSONPGP signature |
| The register: six accounts taken through the help-request channel, June 2022 → November 2025Section 14.1 · section-14-1Read this point in the dossier ↗ | Agent Dora | EN | PDFJSONPGP signature |
| The money trail: liquidity, AML and KYCSection 15 · section-15Read this point in the dossier ↗ | Agent Helen | EN | PDFJSONPGP signature |
| The Digital Services Act: put knowledge on the recordSection 16 · section-16Read this point in the dossier ↗ | Agent John | EN | PDFJSONPGP signature |
| Minors: a Steam login is not an age checkSection 17 · section-17Read this point in the dossier ↗ | Agent Mary | EN | PDFJSONPGP signature |
| A GDPR access request closed without dataSection 18 · section-18Read this point in the dossier ↗ | Agent Viola | EN | PDFJSONPGP signature |
| The Subscriber Agreement against the platform's own architectureSection 19 · section-19Read this point in the dossier ↗ | Agent Beatrix | EN | PDFJSONPGP signature |
| Automation has a paper trail.Part II · Section 1 · part-ii-section-1Read this point in the dossier ↗ | Agent Sean | EN | PDFJSONPGP signature |
| Which key are we talking about?Part II · Section 2 · part-ii-section-2Read this point in the dossier ↗ | Agent Larry | EN | PDFJSONPGP signature |
| The item can be rare. The limit stays.Part II · Section 3 · part-ii-section-3Read this point in the dossier ↗ | Agent Katherine | EN | PDFJSONPGP signature |
| Entrusted with data. Accountable for access.Part II · Section 4 · part-ii-section-4Read this point in the dossier ↗ | Agent Elliott | EN | PDFJSONPGP signature |
| Every amount needs a case.Part II · Section 5 · part-ii-section-5Read this point in the dossier ↗ | Agent Tabitha | EN | PDFJSONPGP signature |
| The Major showcase — skins, stars & demandEvidence file · Major skins · major-skinsOpen the Major skin evidence file ↗ | Agent Simon | EN | PDFJSONPGP signature |