STEAM LINK FILTER — ADDITIONAL PUBLIC-LIST CHECKS
Recorded run date: 6 October 2026
English file publication: 17 October 2026

WHAT WAS TESTED
Two mixed public-feed collections were submitted to Steam's Link Filter.
Neither collection is exclusively Steam phishing. A suitable larger Steam-only
public list was not found, so these relevant collections are reported separately
from the deliberately selected 120-host Steam-impersonation sample.

Gaming-related feeds: DevSpen scam-links and Discord-AntiScam scam-links.
PhishDestroy feeds: our community blocklist and main list.json.
The exact source URLs are listed in summary.json.

RESULTS
Gaming-related feeds: 36,724 hosts; 1,759 blocked (4.79%); 34,965 ordinary notices.
PhishDestroy feeds: 1,086,734 hosts; 4,010 blocked (0.37%);
1,082,629 ordinary notices; 78 ERROR, 15 UNKNOWN and 2 INTERNAL.

The two runs contain 1,123,458 host records. Their overlap is 34,705 hosts,
leaving 1,088,753 distinct normalised hostnames. They are not independent samples.
No pooled blocking rate is published. The 120-host Steam sample and its results
are unchanged: 37/40, 31/40 and 28/40 passed the filter in their respective
historical cohorts; all 7 gambling positive controls were blocked.

READING THE FILES
results.json: complete recorded classifications and run metadata.
responses.tsv: one hostname and recorded response per row.
blocked-hosts.txt: hosts classified BLOCKED.
ordinary-notice-hosts.txt: hosts classified ALLOWED.
unresolved-hosts.txt: ERROR and UNKNOWN hosts; INTERNAL is a separate result.
An empty unresolved file means no ERROR or UNKNOWN records in that collection.

BLOCKED means the collector recorded the 'Link Blocked' response wording.
ALLOWED means it recorded the ordinary 'You are leaving' notice. It is not a
safety verdict and does not mean the destination was live or harmless.
INTERNAL is the collector's redirect classification, not an ordinary notice.

COUNTING
Blocked percentage = 100 x BLOCKED / all unique hosts in that collection.
The 95 residual PhishDestroy records remain in its denominator and are not
counted as ordinary notices. Displayed percentages are rounded to two decimals.
Hostnames are lowercased; leading www. and trailing dots are removed. Subdomains
remain distinct; ports and URL paths are discarded. This is not a count of
registrable parent domains. JSON and TSV agree for every recorded host/result.

SCOPE
The recorded requests used steamcommunity.com/linkfilter/?url=https://HOST.
The collector classified response wording; it did not verify destination content,
current activity, attack success or Valve's internal filtering process.
Per-host response bodies and per-host collection timestamps are not retained.
Public input lists are mutable; frozen per-source membership is not available.
The separate main-list-only figure in the source narrative is not published as
an independently verified cohort because its counts and membership do not reconcile.

VERIFY AN INDIVIDUAL FILE
Download the file and its adjacent .asc signature. Import the publisher's key
from https://phishdestroy.io/.well-known/pgp-key.txt and verify its fingerprint:
129F C7F3 9C40 C69D 2EF3 C329 BFCF 9E8D D295 EE01

  gpg --import pgp-key.txt
  gpg --fingerprint 129FC7F39C40C69D2EF3C329BFCF9E8DD295EE01
  gpg --verify results.json.asc results.json

Each evidence download has its own detached publisher signature. SHA256SUMS is also
signed. These publication signatures are dated when issued, not backdated to the run.
The measurement bytes have not been translated or edited.

ORIGINAL CAPTURE PROOF
Each results.json also retains its original Ed25519 signature and RFC 3161
timestamp response, available separately in the capture-proof section.
The original public key and supplied certificate chain are provided alongside.

  openssl pkeyutl -verify -pubin -inkey source-public-key.txt -rawin \
    -in results.json -sigfile results.json.ed25519.sig
  openssl ts -verify -in results.json.tsr -data results.json \
    -CAfile timestamp-chain.txt

A timestamp establishes that the signed artifact existed by that time. It does
not independently date every request or establish that a classification is true.
The capture key verifies the supplied signature; it does not identify a regulator
or turn the measurements into a judicial determination.