# The Steam Dossier: rules, routes and accountability

Public forensic investigation of Steam OpenID authentication, Valve enforcement, account data access and the market-ceiling economy.

Canonical URL: https://phishdestroy.io/steam_dossier/

Reading edition: 18 October 2026. Language: English.

- [Live article](https://phishdestroy.io/steam_dossier/)
- [Current PDF](https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/en/index.pdf)
- [Article JSON](https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/en/index.content.json)
- [JSON signature](https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/en/index.content.json.asc)
- [Full text](https://phishdestroy.io/steam_dossier/index/llms-full.txt)
- [Reading library and verification](https://phishdestroy.io/steam_dossier/reading_files)

The signature binds the exported text and recorded PDF digest. It does not independently authenticate third-party evidence or determine the merits of the article’s claims.

<!-- seo-2026-10-18:start -->

## Key findings

Each line is one claim from the evidence briefing, with its date and primary source. The limit line states what the record does not establish.

1. In the saved register, 26 of 44 separate-domain platform routes pair a blocked main address with an auth host that returned no Link Filter block (21–22 September 2026). Source: https://phishdestroy.io/steam_dossier/steam_tos_assets/master_registry.json
   Limit: A Link Filter response is not an authentication or account-ban result. No completed login is claimed. Domain registration age does not establish continuous use.
2. Valve’s July 2016 statement identified Steam OpenID and automated accounts as the mechanisms used by gambling sites, and said that use was prohibited (13 July 2016 · later checks in September 2026). Source: https://store.steampowered.com/oldnews/22883
   Limit: Valve has publicly described account restrictions and other actions. Later routes do not prove that every earlier account survived or that no enforcement occurred.
3. The supplied collection contains 2,961 Tier A rows and 6,090 Tier B rows concerning support, account recovery, disputed bans, reported theft and related context (Collected 17 October · reviewed 18 October 2026). Source: https://phishdestroy.io/steam_dossier/steam_tos_assets/support-collection-2026-10-17/manifest.json
   Limit: These are not 9,051 verified incidents or unique victims. Repeated sources, policy material and different outcomes are included. A report of abuse is not proof of staff complicity.
4. The supplied screenshots show a request for API-key creation and usage logs, login and session history, hardware and device authorisation history, and trade and market-offer history, followed by a referral to Account Data and a ticket closure (16–19 September 2026). Source: https://phishdestroy.io/steam_dossier/steam_tos_assets/gdpr-ticket-1.png
   Limit: The account and ticket belong to the respondent who supplied the images, not this project. The capture does not establish a missed statutory deadline or exclude a later response.
5. The published geometry audit records 902,270 non-space characters beneath opaque black rectangles in the supplied 830-page appendix (PDF dated 1 October 2025 · audit 20 September 2026). Source: https://phishdestroy.io/steam_dossier/steam_tos_assets/regulatory-review/disclosure-audit.json
   Limit: This is the authors’ measurement of a supplied file. Only aggregates and its digest are public. No hidden text is reproduced; the result is not a count of victims or proven re-identifications.
6. The atlas’s A+B subset contains 248 categories with corroborating asking prices above the $1,800 headline threshold. All 248 have no Steam listing in that saved snapshot (23 September 2026, 00:44 UTC). Source: https://phishdestroy.io/steam_dossier/steam_tos_assets/cs2sh-atlas.json
   Limit: Asking prices are not completed sales, revenue or losses. An absent listing is a dated observation. Offers across venues can overlap and must not be added as unique items.

## Citation

PhishDestroy Team. “The Steam Dossier: rules, routes and accountability”. PhishDestroy, reviewed 18 October 2026. https://phishdestroy.io/steam_dossier/

```bibtex
@online{phishdestroy_steam_dossier,
  author  = {{PhishDestroy Team}},
  title   = {The Steam Dossier: rules, routes and accountability},
  organization = {PhishDestroy},
  date    = {2026-10-18},
  url     = {https://phishdestroy.io/steam_dossier/},
  urldate = {2026-10-18},
  note    = {Reading edition 18 October 2026. Authored text CC0 1.0.}
}
```

## Case files (canonical URLs)

- [A casino’s business. Inside Steam. — The Steam Dossier](https://phishdestroy.io/steam_dossier/csgofast-sih): The CSGOFast / Steam Inventory Helper case tests Valve’s 2016 enforcement account: Steam integration, remote account operations, authenticator custody and commercial control.
- [Their credentials. Their infrastructure. — PhishDestroy](https://phishdestroy.io/steam_dossier/steam-access): User API keys, publisher keys, Steam session JWTs and dated Link Filter checks: inspect the infrastructure behind the Valve enforcement investigation.
- [The skin moves. The platform decides. — PhishDestroy](https://phishdestroy.io/steam_dossier/gambling-system): The C2C skin transaction, internal balances, valuation and the economic consequences of Steam account restrictions. A linked evidence file in the Valve investigation.
- [How skin casinos use the Steam session — PhishDestroy](https://phishdestroy.io/steam_dossier/trade-tracking): Steam session tokens exported to gambling services, centrally controlled settlement, and CSGOFast’s non-gambling claim. Code, policies and regulatory records.
- [Your documents. Their discretion. — PhishDestroy](https://phishdestroy.io/steam_dossier/aml-data): CSGOEmpire, CSGORoll and CSGOFast: paid coins, KYC withdrawal holds, PayPal gift-code routes and wallet custody. Trace who takes the money, holds the documents and controls the exit.
- [Steam sessions. Platform access. — PhishDestroy](https://phishdestroy.io/steam_dossier/extension-audit): A version-pinned code audit of Steam session-token extraction, renewal and server control in the CSGORoll-linked extension and Steam Inventory Helper.
- [No money? Follow the payment. — PhishDestroy](https://phishdestroy.io/steam_dossier/money-and-enforcement): Follow skin-gambling payments, centralised C2C settlement and the difference between account bans and operator disruption. PhishDestroy investigation.
- [Sponsor rules & cosmetic control — PhishDestroy](https://phishdestroy.io/steam_dossier/major-and-sponsors): Named tournament sponsors, dated Valve licence rules and enforcement of cosmetic exclusivity. Major skin data links to PhishDestroy’s original investigation.
- [Existing data. Selective privacy. — Valve & enforcement · PhishDestroy](https://phishdestroy.io/steam_dossier/privacy-and-enforcement): Valve’s existing device and location data, Wallet age gaps, payment restrictions and the evidence behind moderation decisions.
- [Three games. Unequal protection. — Valve & enforcement · PhishDestroy](https://phishdestroy.io/steam_dossier/three-games-and-security): CS2, Dota 2 and TF2 compared: unequal protection, the 2019 key restriction, the Canadian court record, security failures and farm economics.
- [A rating becomes the entry ticket — PhishDestroy](https://phishdestroy.io/steam_dossier/reviews-and-incentives): SIH review incentives: 84 contest records, supplied review data, developer replies and the commercial system operating inside Steam.
- [Valve’s defence. Valve’s control. — PhishDestroy](https://phishdestroy.io/steam_dossier/valve-and-enforcement): Valve’s response to New York examined against its agreement, enforcement record, device data and disclosure decisions. Eight documented statement analyses.

## Datasets

- [Evidence briefing, six findings (JSON)](https://phishdestroy.io/steam_dossier/exports/investigation-review-2026-10-18/briefing.json) · [signature](https://phishdestroy.io/steam_dossier/exports/investigation-review-2026-10-18/briefing.json.asc) · CC0 1.0
- [Steam Support collection, 9,051 rows (CSV)](https://phishdestroy.io/steam_dossier/steam_tos_assets/support-collection-2026-10-17/records.csv) · [JSON](https://phishdestroy.io/steam_dossier/steam_tos_assets/support-collection-2026-10-17/records.json) · [manifest](https://phishdestroy.io/steam_dossier/steam_tos_assets/support-collection-2026-10-17/manifest.json) · CC0 1.0

<!-- seo-2026-10-18:end -->