{
  "title": "Additional Steam Link Filter checks against mixed public lists",
  "collection_date_as_reported": "2026-10-06",
  "publication_date": "2026-10-16",
  "source_archive_filename": "steam_linkfilter_report.zip",
  "source_archive_sha256": "050142b336e19e0e2521b890a68f0d40be7b4e4bbbde4d184994d5fe9cc9eac8",
  "unit": "unique normalized host within each batch; subdomains retained",
  "scope": "Two mixed public-feed cohorts. Neither is exclusively Steam phishing. Separate from the selected 120-host Steam-impersonation sample.",
  "denominator": "all unique hosts in that batch, including unresolved statuses",
  "status_meanings": {
    "BLOCKED": "Collector recorded the Link Blocked wording.",
    "ALLOWED": "Collector recorded the ordinary You are leaving notice; not a safety verdict.",
    "UNKNOWN": "Unrecognized response.",
    "ERROR": "Unresolved request error.",
    "INTERNAL": "Collector classified a redirect as internal; not counted as ALLOWED."
  },
  "batches": [
    {
      "id": "batch1_discord_steam",
      "total": 36724,
      "counts": {
        "ALLOWED": 34965,
        "BLOCKED": 1759
      },
      "blocked_pct_all": 4.789783248012199,
      "allowed_pct_all": 95.2102167519878,
      "blocked_pct_classified_only": 4.789783248012199,
      "unresolved_count": 0,
      "generated_at_unzoned": "2026-10-06T11:05:15",
      "sources": [
        "https://raw.githubusercontent.com/DevSpen/scam-links/refs/heads/master/src/links.txt",
        "https://raw.githubusercontent.com/Discord-AntiScam/scam-links/main/list.txt"
      ],
      "signatures": {
        "results.json": true,
        "manifest.sha256": true,
        "provenance.head.json": true
      },
      "provenance_chain_verified": true,
      "provenance_generated_utc": "2026-10-06T18:13:37Z",
      "timestamps": [
        {
          "file": "results.json",
          "data_token_and_supplied_chain_verified": true,
          "timestamp": "Time stamp: Oct  6 18:09:56 2026 GMT",
          "output": "Verification: OK\nUsing configuration from /usr/lib/ssl/openssl.cnf"
        },
        {
          "file": "provenance.head.json",
          "data_token_and_supplied_chain_verified": true,
          "timestamp": "Time stamp: Oct  6 18:13:47 2026 GMT",
          "output": "Verification: OK\nUsing configuration from /usr/lib/ssl/openssl.cnf"
        }
      ],
      "results_sha256": "2e54e09a597ef6f927989d6d43d23a81ef9f3c5e11eba3b3a604545fb3036075",
      "tsv_sha256": "4177b4f338fa2cc10e708aba03dfc5d0c599d49a81a3e4bdd4d60c7506618450",
      "public_key_sha256": "c43ccf59a7f76e39a7a63006561c6fc1a04a98cb8f50a2023d8c6c078f3f8dd8"
    },
    {
      "id": "batch2_phishdestroy",
      "total": 1086734,
      "counts": {
        "ALLOWED": 1082629,
        "BLOCKED": 4010,
        "UNKNOWN": 15,
        "ERROR": 78,
        "INTERNAL": 2
      },
      "blocked_pct_all": 0.36899554076710583,
      "allowed_pct_all": 99.62226266961372,
      "blocked_pct_classified_only": 0.36902780040105315,
      "unresolved_count": 95,
      "generated_at_unzoned": "2026-10-06T11:25:54",
      "sources": [
        "https://raw.githubusercontent.com/phishdestroy/destroylist/main/community/blocklist.json",
        "https://raw.githubusercontent.com/phishdestroy/destroylist/main/list.json"
      ],
      "signatures": {
        "results.json": true,
        "manifest.sha256": true,
        "provenance.head.json": true
      },
      "provenance_chain_verified": true,
      "provenance_generated_utc": "2026-10-06T18:26:29Z",
      "timestamps": [
        {
          "file": "results.json",
          "data_token_and_supplied_chain_verified": true,
          "timestamp": "Time stamp: Oct  6 19:50:43 2026 GMT",
          "output": "Verification: OK\nUsing configuration from /usr/lib/ssl/openssl.cnf"
        },
        {
          "file": "provenance.head.json",
          "data_token_and_supplied_chain_verified": true,
          "timestamp": "Time stamp: Oct  6 18:26:30 2026 GMT",
          "output": "Verification: OK\nUsing configuration from /usr/lib/ssl/openssl.cnf"
        }
      ],
      "results_sha256": "01ef61bc2d504d7c9cce5372cb9c95f88c23c7208ab578dec270f0b91f329b5d",
      "tsv_sha256": "992963d610884a8c32ac9eeb92d7027b7a840b2447cebd6e3e8f412c09ac91ea",
      "public_key_sha256": "c43ccf59a7f76e39a7a63006561c6fc1a04a98cb8f50a2023d8c6c078f3f8dd8"
    }
  ],
  "cross_batch": {
    "sum_of_batch_sizes": 1123458,
    "overlapping_hosts": 34705,
    "unique_hosts_across_both": 1088753,
    "overlap_status_pairs": {
      "ALLOWED/ALLOWED": 33057,
      "BLOCKED/BLOCKED": 1647,
      "ALLOWED/ERROR": 1
    },
    "conflicting_statuses": [
      {
        "host": "damned2023.com",
        "batch1": "ALLOWED",
        "batch2": "ERROR"
      }
    ],
    "pooled_block_rate_published": false
  },
  "crypto_themed_blocked_examples": [
    "app-metamask-kyc-auth.com",
    "app-trezor-auth.com"
  ],
  "interpretation": "Observed coverage of these supplied lists on the stated date. No population-wide detection rate, site-liveness claim, or inference about Valve internal processes.",
  "integrity_scope": "Counts recounted from JSON and TSV, manifest hashes and Ed25519 signatures verified, RFC 3161 tokens checked against actual data and supplied certificate chains. This verifies supplied artifacts, not truth of classifications or signer identity.",
  "file_publication_date": "2026-10-17",
  "publication_format": "Individual files, each with a detached publisher OpenPGP signature",
  "downloads": "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-audit-2026-10-06/",
  "measurement_bytes_changed": false
}