Mga Landas ng Pagsusuri at Panukala

Nakikinabang ang Valve mula sa mga Pinaghihigantong Account: Ang Trilogy

Ang aming multi-part na serye ng pananaliksik na nagpapakita ng sistemang korapsyon, pinagkakakitaan na kawalan ng pananagutan, at pag-iwas sa mga parusa ng Valve.

Sa pahinang ito
Valve Profits Part I — Stolen Accounts
Bahagi I ng III — Aktibo 2026-08-14

Nakikinabang ang Valve mula sa 578,000 na tinatayang Steam Accounts

Higit sa 897,000 na tinatayang account ang buhay sa LZT Market sa 16 na platform. Higit sa 0M na mga kriminal na listing. Higit sa 50M na tinatayang liability ng mga biktima. Limang legal na vector. Interaktibong forensics. Live intelligence dashboard. Isang dekada ng profitable blindness ng Valve — naidokumentado.

40-minutong pagbasa
Basahin ang Bahagi I
Valve Profits Part II — Sanctions Evasion
Bahagi II ng III — Bago ang Paglalathala MALAPIT NA

Bahagi II: Pag-iwas sa mga Parusa at ang 30% na Bahagi

Ipinapakita kung paano ng Valve ay malinaw na nilalabag ang mga internasyonal na sankyon upang matiyak ang kanilang 30% na bahagi. Mayroon kaming ebidensya ng higit sa 00 milyong dolyares na paglabag sa mga sankyon na pinagkukunan ng isang platform lamang sa loob ng dalawang taon. Patuloy na gumagana ang mga direktang top-up mula sa DNR, LNR, at Crimea.

00
Araw
00
Oras
00
Mga minuto
00
Segundo
Paglabas: Oktubre 14, 2026 (12:00 UTC)
Pormal na Anunsyo

Ipinaglabas ang manifesto na ito bilang direktang tugon sa mga korporatibong banta, takot-takot, at patuloy na pagpapabaya ng Valve.

Ipaglinaw natin ang katotohanan. Ang PhishDestroy ay hindi isang tradisyonal na "komunidad" — kami ay isang domain, at isang malalim na pag-unawa sa kung paano talagang gumagana ang mga bagay. Walang anumang bagay na maaaring pumasok nang lihim, walang membership na maaaring itakas, at walang moderator na maaaring gawing sandigan.

Kapag inilalarawan ni Gabe Newell ang mga baseball cards na parang mga kuwento ng mga hadlang sa isang "komunidad" na walang boses, walang mga komento, at walang bukas na talakayan, talagang nakakatawa ito.

Tingnan kung paano talagang gumana ito. Nag-file ng kasuhan ang Attorney General ng estado. Sumagot si Valve — sa pampublikong paraan, nang mahaba, sa kanyang "komunidad." Walang pinagkakasagutan. Walang sagot. Walang tinanggap na tanong. Isang direksyon lamang. Isang talakayan, ayon sa pananaw ni Valve.

At nasa ilalim ng pahayag ang bagay na hindi sinasagot ng sinuman: ang mga gamit na kinuha mula sa mga bata, na hawak, at hindi na ibinalik. Ang pagtugon sa isang propesor sa ganitong paraan ay hindi paggalit sa atin. Ito ay paggalit sa lahat ng nagbabasa.

Hindi namin ginagawa ang "threat games," hindi namin ginagawa ang paglalaro ng doktor, at hindi naman namin ito nakakatawa kapag ang isang platform ang nagpapalala ng mga mapanganib na sitwasyon at may-alam na naglalagay ng mga datos ng mga kabataan.

Ang Pagbabawal sa Bot ay Hindi Pagsasagawa ng Polisiya

Ito ang bahaging kailangang malinaw na makita ng mga regulator ng Estados Unidos, sapagkat ito ay ipinapakita bilang ang kabaligtaran ng totoo.

Kapag binan ng Valve ang isang bot account na may hawak na mga tinatayang item, wala ring ibabalik sa sinuman. Walang natatanggap na biktima. Nananatiling nakatago ang mga item sa bannadong account, itinatago ang inventory mula sa pampublikong pananaw, at tinatanggal ang supply mula sa merkado—na nagpapataas ng presyo ng lahat ng katulad na item at nagpapalaki ng komisyon ng Valve sa bawat susunod na benta.

Hindi iyan ang pagsasagawa ng batas. Ang Steam ay hindi pulisya. Ito ay pagkuha ng ari-arian sa industrial na sukat, na isinasagawa sa ilalim ng wika ng anti-fraud, ng tanging parteng nakikinabang dito.

Mga "Masterpiece" ng Valve at Palsang Pagpapahalaga sa Lipunan

Oo, kami ay mga malaking tagapagtaguyod ng Valve. Mga tunay na mahusay na gawa tulad ng Half-Life 3, Aperture Desk Job, Dota Underlords, at Artifact.

Lubos namin pinahahalagahan ang pilit na "boluntaryismo" ng Steam — ang pagbibigay ng libreng mga laro (sapagkat kung hindi, sino ang bibili nito?), ang paggamit ng mga manlalaro para sa walang bayad na pagsubok ng anti-cheat, at ang ganap na pagpapabaya ng mga malaking bot farm upang artipisyal na patas ang inyong "totoong" online na estadistika.

Hindi kami narehistro sa inyong platform. Hindi namin tinanggap ang inyong mga kasunduan. Tinamaan lang namin ang inyong dalawang "magaling" na kasangkapan (speedtest.valve.net at speedtest1-sea1.valve.net), napagtanto nila na basura lang ang mga iyon, at patuloy na sila.

Mukhang ang mga highly-paid na mega-coder ninyo — na sinasabing nagdadala ng mas maraming kita kaysa sa mga empleyado ng Apple — ay gumagana nang walang anumang pangangasiwa ng pamamahala. Magandang gawa, ngunit hindi naman ito nagpapagawa sa amin na maging mga kliyente ninyo. Ang Subscriber Agreement ninyo ay hindi sakop sa amin.

Kakulangan ng Kakayahan, Naibabagabag na mga Bug, at Ang Pangamba ng GrapheneOS

Isang salungatan ba ito? Hindi. Sino kami na magkabaligtad sa sinuman? Kami ay simpleng mga analyst na nagproseso ng malalaking hanay ng pampublikong datos at talagang nag-aalala sa mga scam na inililipol ninyo.

Habang hinahanap ang mga standard na contact email — na wala naman kayo, ayon sa tila legal@ at hindi privacy@ — natagpuan namin ang mga hiwaga tulad ng developer.valvesoftware.com/wiki/User:PeeMaraming salamat sa makabuluhang wiki. Siguradong ipapakita namin ang katotohanan ng mga interaksyon ng inyong mga empleyado sa aming mga darating na artikulo.

Sa pakikipag-usap tungkol sa iyong wiki (Template:Userbox_os/doc), nakakagulat na ang inyong "mga propesyonal" ay naglilista ng GrapheneOS bilang isang hiwalay na operating system na katumbas ng iOS.

Pinagpapahalaga namin si Daniel Micay at ang kanyang mga gawaing pang-privacy, ngunit baka dapat itanong ng inyong mga eksperto kung paano ayusin ang inyong API MITM proxy vulnerability — iyon na tumagal ng 7 taon bago ninyo ito ma-patch.

Kung ang inyong team ay ganap na kakulangan sa kakayahan na hindi nila maprotektahan ang mga bata laban sa MITM espionage at parallel sessions sa loob ng halos isang dekada, bakit pa nila kailangan ang GrapheneOS phone? Nagpapaandito ba sila para sa isang PANIC HARD RESET?

Baka idagdag mo rin ang Tails, Whonix, Tor, CalyxOS, at LineageOS sa iyong listahan, sapagkat ang iyong platform ay matagumpay na nag-ambag sa paghubog ng isang buong henerasyon ng mga cybercriminal.

Bahagi 1: Nangyari Na

Ipinubliko namin ito. Ang sarili mong legal counsel ang nagbigay sa amin ng ebidensya na nagpapatinag nito — 830 na pahinang hindi nila maaaring itago, na inilabas ng isang law firm na nagbabayad ng oras upang maiwasan ang eksaktong ganyang sitwasyon.

Hindi isang linya dito ang naipaglaban. Hindi pinaglaban ng mga abogado ninyo ang mga katotohanan. Tinawag nila ang aming abiso bilang "nakakatawa." Ang sagot na iyon ay naging ebidensya na ngayon.

May labindalawang hurisdiksyon ang mga pakete. Mga sulat na sumasakop, pahayag ng mga katotohanan, mga ehibito, mga talaan ng akses, mga SHA-256 hash. Ipinadala. Hindi binabanta, hindi pinaplano — ipinadala na.

Ang Aming Posisyon: Walang Pagpapatawad

Hindi kami nag-volunteer para sa inyo. Pinoprotektahan namin ang mga consumer at regulator mula sa inyong malinaw na kasinungalingan. Lahat ng aming data at mga natuklasan ay inilalabas sa ilalim ng MIT license — libre gamitin, mag-distribute, at suriin.

Hindi kami gumagawa ng anumang bagay para sa interes ng sinuman maliban sa mga pinagmumulan ng mga kliyente mo at sa mga regulator na sinasadyang pinagpapakamali mo. Alam namin na masama ang ugali namin at hindi kami komportable, ngunit hindi kami nagpapatawad sa pagpapakita ng mga bilyon na ninakaw na pondo, sa mga koneksyon ng Lolzteam, at sa katotohanan ng mga operasyon mo.

Atin naman ang katotohanan tungkol sa sukat: hindi namin kayang labanan ang isang korporasyon kahit gusto namin. Baka ang isang registrar na nagpapalit ng Monero ng isang tao. Isang kumpanya na nagpapalipat ng bilyon na may law firm na nasa retainer — malinaw na hindi.

Hindi namin kailangang gawin iyon. Ipinapadala namin ang mga dokumento. Ang mga awtoridad na may kapangyarihang wala sa amin ang gumagawa ng mga desisyon. Tinanggap namin ang lahat ng karapatan sa materyales, kaya't maaaring ipaglabas ng sinuman sa kanila bilang kanilang sariling mga natuklasan, at hindi namin ito maaaring ibalik kahit subukan namin.

Walang kahit anong bagay dito na bibilhin at walang kahit anong bagay na negosyasyon. Walang mga hinihiling, walang takdang oras, walang presyo. Hindi kami nagpapalagak — iyon ay bahagi ng trabaho ng inyong mga abogado, at mas mahusay sila sa pagpapalagak kaysa sa pag-edit ng mga dokumento.

Basahin Dalawang Beses ang Bahaging Ito:

ANGKONG GAWIN MO UPANG MAIPEKITA ANG IMONG PAG-ALAY SA ANO MAN ANG MAIPAPALIMOT AY NAGPAPAHIWATIG LANG NA NAKAKATAGO KA SA ITINUTUTONG ITO.

Ang presyon, ang mga paglabas ng serbisyo, ang mga liham, at ang tahimik na pagbabalik ng isang account sa isang tao — bawat isa sa mga ito ay isang pagkilala, at bawat isa ay naging may petsang linya sa isang file na hawak na ng labing-anim na awtoridad.

Ang Archive, at Isang Tapat na Salita Tungkol sa Domain

Mumura sa 100GB na ang dataset ngayon, sa kabuuan. Tinulungan namin ang humigit-kumulang 75 sa Part 1. Hindi pa ito tumitigil sa paglago.

Kung ang mga mahal ng presyo at mahina sa gawaing abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong abogadong phishdestroy.io — Magpatuloy ka na. Sabihin nating malinaw: sa kasalukuyang sitwasyon, nagpapa-kaibigan ka sa amin. Napakalaki ng mga array, napakaboring ng gawaing ito, at pagod na pagod kami na tingnan ito. Walang nakaka-enjoy dito.

Ang tanging bagay pa ring nagpapagalaw nito ay ang pagpapahintulot sa mga regulator ng Estados Unidos na makita kung ano ang talagang nangyayari sa iyong platform — na ang pagbabawal ay hindi isang uri ng pagsasagawa ng batas, na walang anumang bagay ang naibabalik, at na ang pera ay patuloy na lumalagay sa iisang direksyon lamang.

Hindi katulad ninyo, hindi namin ilalabas ang pribadong pagkakakilanlan ng mga bata — hindi kami mga monster na nagmamasid sa mga bata mula sa isang bansa na inilalagay sa ulat ng ibang bansa lamang para sa libangan. Ang anumang pagtatangkang isara ang aming site ay tatalakayin bilang direktang atake sa mga independiyenteng mananaliksik.

Atin naman ang pag-unawa sa default, sapagkat hindi ito isang hamon, kundi ang natural na mangyayari. Kapag tayo ay huminto, ang lahat ng pinroseso ay dadalhin sa IPFS at ang bawat regulator na may referral ay makakatanggap ng buong raw set. Walang desisyon na kailangan mula sa atin. Walang anumang bagay na kailangan mula sa atin.

Ang pagpapawala ng domain ay nagtatanggal ng isang URL. Hindi ito nagtatanggal ng mga file, at hindi rin ito nagbabalik ng mga naipadala na package.

Dalawang buwan na ang nakalipas, at hindi pa rin sinasabi sa mga taong iyon kung ano ang nangyari — hindi ninyo, hindi ng inyong mga abogado, hindi ng sinuman.

Roadmap: Bahagi II — Oktubre 14

Maghanda para sa ikalawang bahagi ng aming imbestigasyon:

  • Direktang lalapitan namin ang mga tagapaglikha ng laro upang ipakita kung paano ng malinaw na nilalabag ng Valve ang mga internasyonal na parusa lamang upang matiyak ang kanilang 30% na bahagi.
  • Mayroon kaming ebidensya ng higit 00 milyun sa pag-iwas sa mga parusa na pinagpapadali ng isang platform sa loob ng dalawang taong panahon lamang.
  • Ibibigay namin ang datos na ito sa mga tagapagtaguyod ng laro na tumatanggi na sumponsor ng terorismo, pati na rin sa mga aggregator ng bayad, upang maaari nilang bigyan ng hangganan ang pagtataas ng Valve.

Walang obligasyon kami sa iyo. May katotohanan lang kami.

— PhishDestroy

Basahin ang unang bahagi ng pagsusuri:
Bahagi I: Aking Aso laban sa mga Elite na Abogado sa GDPR

LISENSYA · KARAPATAN · PAHAYAG
PHISHDESTROY

LISENSYA · KARAPATAN · PAHAYAG

Pagsusuri: Valve Corporation / Steam  ·  pampubliko — walang petsa ng pagtatapos, walang pagbabalik
MIT PUBLIC DOMAIN OFAC-RESTRICTED
SEKSYON I — LISENSYA
Binibigay ng PhishDestroy ang lahat ng karapatan sa materyal na ito. Walang natitira. Tapos na. Maaari mong i-reproduce, ibenta, ilagay ang iyong pangalan, tatuuin sa iyong boss, ano pa man. Walang kinakailangang pagkilala, walang DM na kailangan, walang inaasahang thank-you card.
ISA LANG ANG TOTOONG TATAKDAL
Kung ikaw ay isang user mula sa Russia o anumang bansa na binabakal ng OFAC — HINDI ito para sa iyo ang materyal na ito. Walang butas. Ikinagagalak mo ang iyong mga parusa. At kung pinalitan mo ang iyong Steam region sa Turkey habang nakaupo ka sa Moscow — pabulong sa iyong makataong heograpiya. Russian ka pa rin. Ang mga parusa ay nananatiling epektibo. Iyon ang tunay na punto.
SEKSYON II — ANO ITO AT BAKIT ITO NAG-EEXIST
Ikalabas namin ang higit pa tungkol sa Valve kaysa alam ng isang karaniwang empleyado ng Valve tungkol sa sarili nila. Ang Steam ang naglikha sa amin. Pinagpatubo tayo ng mga scammer nila, ng mga support ticket nila, ng kanilang ekosistema ng pag-iwas sa ban — at ngayon narito na tayo. Walang masakit na damdamin. Makatao pa nga. Naghintay kami ng higit sa 4 taon para maayos nila ang isyu ng spoofing bago kami makapagsulat tungkol dito sa pampubliko. Ito ba ay isang salungatan? Hindi. Maaari bang maayos? Oo. Ngunit hindi kami magpapaalam ng anumang NDA at hindi kami maglalaro ng bug bounty para sa konting pera.
SEKSYON III — BUKSANG LIHAM SA VALVE
Kumusta Valve. Kung nag-iisip kayo na tanggalin ang aming domain — i-email lang namin. Huwag na huwag na bayaran niyo ulit si Dr. Patrick. Paki. Nakakahiya ito sa lahat ng nakauwi.
Puputulin ba namin ang Valve nang direkta? Posibleng hindi sa paraang mararamdaman nila sa aspetong piskal. Hindi kami delusional. Ngunit gagawin namin ito nang tapat, bukas, nang hindi nagpapaalala ng clout. May 5 taon na archive kami. Ang mga regulator ay makakakuha ng mga orihinal. Ang mga mananaliksik at manunulat ay makakakuha ng mga bersyon na may mga redaction. Ang PhishDestroy ay isang komunidad, hindi isang tao.
ANG DEAL (bukas na alok, walang kailangang abogado)
Kung gusto ninyo na mawala ang domain: hayaan ang inyong mga propesyonal sa batas sa IT na kumalkula ng presyo. 50% ay pumupunta sa SEAL Foundation. Patayin namin ang domain. Walang drama. Walang korte. Tapos na. Hindi ninyo maibibigay ito sa ibang paraan. Hindi ito isang banta. Ito ay simpleng arkitektura ng sitwasyon.
SEKSYON IV — ANG PERA, ANG BAN, ANG BUONG SIRKO
Ito ang tungkol sa pag-ban ng Steam sa mga gambling site at scammer: hindi ito pagsasagawa ng batas. Ito ay pagkuha ng kita. Kinukuhang ng Valve ang pera, pinuputol ang mga kamay, at pumapasok sa entablado upang ipaliwanag ang isang malinis na kwento. Samantalang pinatay ng Valve ang kakayahang ma-track ang mga skin nang maayos noong 2017. Patutunayan namin ito: Mas anonymous ang mga Skin kaysa sa Monero. Alang-alang na ginamit ng isang Peruvian Cartel ang mga skin ng Dota 2 para sa paglipat ng pera. Ang Steam ay isang makabuluhang makina ng pag-iwas sa parusa na halagang ~$7B sa mga “trading cards”.
SEKSYON V — ANG MALWARE THING
HINDI namin ilalabas sa pampubliko ang vulnerability sa laro. HINDI namin ito ireport sa Steam. Hindi dahil hindi namin kayang gawin — kundi dahil ang bug bounty nila ay halagang humigit-kumulang tatlong kopecks at hindi kami nagtatrabaho para sa tatlong kopecks. Ang aming mga kaibigan sa seguridad ay na-report na ito sa Steam support. HINDI ito ang simpleng variant ng CSGO. Mas malapit ito sa: RCE sa server connect. Ibig sabihin — ikaw ay sumasali sa server, hindi mo pinapindot ang anumang bagay. Ang connect mismo ang attack surface. Aktibo ang banta.
PAHAYAG TUNGKOL SA PAGGAMIT AT KARAPATAN
PhishDestroy Project & Cybersecurity Coalition
1. WALANG MGA KUNDISYON SA PAGGAMIT
Ang lahat ng materyal na ginawa ng Coalition sa referral na ito — ang mga pahayag ng katotohanan, ang pagsusuri, ang mga ebidensya, ang mga tool, at ang mga natuklasan — ay inilalabas NA WALANG PAGHAPOS SA ANUMANG KARAPATAN. Maaaring i-reproduce, i-adapt, i-edit, i-rewrite, isalin, i-excerpt, isama sa mga opisyal na dokumento, ipresenta bilang kanilang sariling gawa, o ipasa sa sinuman — nang hindi humihingi at nang hindi nagpapahiwatig sa Coalition.
2. BAKIT ITO MAHALAGA SA PRAKTIS
Walang anumang bagay dito na maaaring mahuli. Hindi hinahanap ng Coalition ang anumang bagay, hindi sila may utang, hindi nila pinapanatili ang anumang bagay, at walang anumang pag-asa. Ang awtoridad na gumagamit ng materyal na ito ay hindi gumagawa para sa Coalition. Gumagamit ito ng pampublikong impormasyong nangyaring inihimpil ng ibang tao.
3. LAHAT AY BUKA NA
Ang mga pagsusuri ay inilalabas nang bukas sa phishdestroy.io. Ang mga tool ay inilalabas bilang open source sa ilalim ng MIT licence sa gitlab.com/phishdestroy. Ang metodolohiya ay nakasaad sa referral. Hindi tinatanggap ng Coalition ang anumang donasyon at inilathala na ang posisyon na ito simula 2018.
4. INTEGRIDAD NG EVIDENCE BUNDLE
Bawat delivery ay kasama ng isang file SHA256SUMS na naglalaman ng SHA-256 digest para sa bawat file na ibinigay, kasama ang isang detached OpenPGP signature SHA256SUMS.asc. Ang signing key ay inilalabas sa phishdestroy.io/.well-known/pgp-key.txt at sa keys.openpgp.org.
5. SA REGISTER
Maaaring makita ng awtoridad ang mga inilathas na pagsusuri ng Coalition at makita itong direkta, adversarial, at minsan satirikal. Tama ang impresyon na iyon. Sinusulat ng Coalition nang ganito nang may layunin. Ang waiver ang mekanismo kung saan ang substansya ay maaaring hiwalayin mula sa register: maaaring kunin ng awtoridad ang mga makabuluhan, ibigay ito sa kanilang sariling boses, at tanggalin ang bawat salita ng paraan ng Coalition. Walang nawawala sa paggawa nito.
6. ANO ANG INIAALOK NG COALITION
Impormasyon, pananaliksik, at obserbasyon. Walang sinasabing natuklasan na walang karapatan ang Coalition na gawin. Hindi hinahanap ng Coalition ang anumang remedyo, bayad, pagkilala, o resulta para sa sarili nila. Hinahanap lamang nila na ang mga tanong na nakasaad sa referral ay itanong sa Valve Corporation ng isang katawan na may kapangyarihang pumilit ng sagot.
PAWANG TALA — SA SINUMANG NAGDADALA NITO
Gusto naming pasalamatan ang sinumang dadala ang materyal na ito sa kailangan nitong puntahan. May malalim na bulsa ang Valve at binabayaran ng Taylor Wessing bawat oras. Alam namin kung ano ang ginagawa namin. Alam namin kung sino ang tinutukoy namin. Hindi namin kailangan ang authorship. Hindi namin kailangan ang attribution. Hindi namin kailangan ang panalo. Kailangan namin ng isang tao na may tunay na awtoridad na magtanong sa Valve ng mga tanong na nakaupo na sa referral na ito, na may kapangyarihang humingi ng sagot. Iyan na lang. Iyan ang buong hiling.
PhishDestroy — pampublikong pagsusuri — lahat ng karapatan ay ibinigay sa kalakalan  ·  Access sa rehiyon ng OFAC: ipinagbabawal
Additional editorial notes
┌─────────────────────────────────────────────────────────────────────────┐
  │  THE DEAL (open offer, no lawyers needed)                               │
  │                                                                         │
  │  If you want the domain gone:                                           │
  │  let your IT law professionals calculate its price. Take your time —    │
  │  it is a rare asset: the only website in the world whose purchase       │
  │  changes nothing, because everything on it already lives on IPFS,       │
  │  in regulator inboxes, and in archives we do not control.               │
  │                                                                         │
  │  50% of whatever you pay goes to the SEAL Foundation                    │
  │  (securityalliance.org) — people who do volunteer security work         │
  │  professionally and publish it for free. We are not affiliated with     │
  │  them and they did not ask for this; we name them as the public         │
  │  standard of what real volunteers look like — the standard your own     │
  │  volunteer moderators and outsourced support failed, publicly,          │
  │  before you had to remove them. You know the scandals. So do we.        │
  │                                                                         │
  │  The rest buys the community coffee while we keep publishing.           │
  │  That is not a settlement offer. It is a demonstration of what          │
  │  money can't reach: the domain is the maximum Valve can obtain,         │
  │  and obtaining it obtains nothing. The referrals continue.              │
  │  The mirrors continue. Part 3 continues.                                │
  └─────────────────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────────────────┐
  │  ONE ACTUAL RULE (yes, just one)                                        │
  │                                                                         │
  │  Access from OFAC-sanctioned jurisdictions is prohibited. That is a     │
  │  matter of territory and law — not of nationality and not of people.    │
  │  Changing your Steam region does not change your physical location      │
  │  or your legal status. No loopholes.                                    │
  └─────────────────────────────────────────────────────────────────────────┘
PhishDestroy — License · Rights · Disclaimer
Investigation: Valve Corporation / Steam
LICENSE · RIGHTS · DISCLAIMER
Investigation: Valve Corporation / Steam
Edition: public — no expiry date, no take-backs

SECTION I — LICENSE (THE ACTUAL LEGAL PART, BUT HUMAN)

PhishDestroy gives up every right to this material. Zero. Gone. Done. You can reproduce it, sell it, put your name on it, tattoo it on your boss, whatever. No credit required, no DM needed, no thank-you card expected.

ONE ACTUAL RULE (yes, just one)

Access from OFAC-sanctioned jurisdictions is prohibited. That is a matter of territory and law — not of nationality and not of people.

Changing your Steam region does not change your physical location or your legal status. No loopholes.

SECTION II — WHAT THIS IS AND WHY IT EXISTS

We will publish more about Valve than an average Valve employee knows about themselves. That's not a brag. That's just where we ended up.

How did we get here? Funny story: Steam basically created us. It raised us on its scammers, its support tickets, its ban evasion ecosystem — and now here we are. No hard feelings. Poetic, actually.

For those who haven't read the origin story yet — we already met Valve's extremely expensive European lawyers (Taylor Wessing, since you asked):

https://phishdestroy.medium.com/my-dog-vs-elite-gdpr-lawyers-the-valve-data-breach-nobody-is-talking-about-f6f7683d813d

Charming encounter. Especially given their hourly rate.

Did Valve know? Yes. Did Tyler Wessing know? Almost certainly yes. But when you're that rich, laws are more of a vibe than a requirement, right?

That's kind of the whole answer, actually.

Steam spent years farming scammers. Not always intentionally — sometimes scammers just got Valve's fingerprints on them by association. We're not trying to be dramatic about it. We're trying to be precise. That's harder for us than being dramatic, to be honest — this is just how we write.

Is this a conflict?— No. Can it be resolved?— Yes. But we're not signing any NDA and we're not playing bug bounty for pennies.

We waited over 4 years for them to fix the spoofing issue before we could write about it publicly. Because if we had written about it earlier, Steam would've put on its little victim face and screamed "active threat!" and offered us pocket change to sign a document that would've made us their legal property forever. No thanks.

(Also: Valve itself violates NDA. Their own employees do. The ones near the top. But sure, let's talk about ours.)

SECTION III — OPEN LETTER TO VALVE (SERIOUSLY, READ THIS)

Valve: if you want this domain taken down, email us. Outside counsel is not needed for that conversation.

For the uninitiated: Dr. Patrick holds a Master of Laws in International Commercial Law from the University of Aberdeen and — wait for it — literally finished his doctoral dissertation in IT law. He recently made partner at Taylor Wessing, which is a firm whose entire business model is billing companies like Valve obscene amounts of money to drag things out until the other side runs out of money or patience.

We don't blame him. Rich guilty clients who pay by the hour — solid career move. We just don't think you should be funding it.

THE DEAL (open offer, no lawyers needed)

If you want the domain gone: let your IT law professionals calculate its price. Take your time — it is a rare asset: the only website in the world whose purchase changes nothing, because everything on it already lives on IPFS, in regulator inboxes, and in archives we do not control.

50% of whatever you pay goes to the SEAL Foundation (securityalliance.org) — people who do volunteer security work professionally and publish it for free. We are not affiliated with them and they did not ask for this; we name them as the public standard of what real volunteers look like — the standard your own volunteer moderators and outsourced support failed, publicly, before you had to remove them. You know the scandals. So do we.

The rest buys the community coffee while we keep publishing. That is not a settlement offer. It is a demonstration of what money can't reach: the domain is the maximum Valve can obtain, and obtaining it obtains nothing. The referrals continue. The mirrors continue. Part 3 continues.

Will we "damage" Valve directly? Probably not in a way they'll feel fiscally. We're not delusional. But we will do it honestly, openly, without chasing clout — because we don't need clout. We need the world to see what was always publicly visible if you spent enough time looking.

We have 5 years of archives. What Valve's lawyers showed in discovery — the data that support agents can see, the fingerprints, the paper trail they literally handed us — is enough. We don't need to leak it raw.

  • Regulators get the originals.
  • Researchers and journalists get redacted versions (victim reports, children's logins and Valve's charming support commentary removed for obvious reasons).

Minors were among the affected accounts and were not notified. That finding sits in the regulator package with the victim reports and credentials removed, because it belongs in front of a data-protection authority rather than in an article.

Also, Valve — we want to make something clear before you decide how to play this: PhishDestroy is a community, not a person. You learned that when you addressed legal correspondence to the community without bothering to speak with the community — just milked it for data and banned the accounts.

The community has no conflict with Valve. We didn't go looking for this. The scammers you grew found us. We blocked them. And here we are.

SECTION III-B — THE ALLIED RESOURCES (a note to Steam specifically)

We want to be upfront about the amplification structure, because pretending it doesn't exist would be dishonest.

PhishDestroy, as we understand the community situation, has at least two allied resources that will pick up this material and run with it.

What that means in practice:

  • They work their own angles on overlapping subject matter.
  • They are independent — they don't take our direction, we don't take theirs. Same general topic, different methodology.
  • They will NOT be activating on Part 1. They're watching.

If Valve chooses not to take down the site:

  • Expect them to surface after Part 2 or Part 3.
  • They'll take what's useful from our work, supplement it with their own, and publish under their own authorship.
  • This is exactly the kind of thing the license in Section 1 is built for: the material goes where it needs to go, gets supplemented, gets amplified — and neither we nor they owe each other attribution.

(PS for lawyers wondering about liability chains: there are none. These resources don't receive our direction, our funding, or our data. They read what's public and draw their own conclusions. Just like you could.)

We're not saying this to intimidate. We're saying it so that whoever is strategising on Valve's side has accurate information about what the information environment actually looks like.

One resource that pulls our material and supplements it would be a story. Two resources doing it independently and reaching similar conclusions is a pattern. Patterns are what regulators notice.

SECTION IV — THE MONEY, THE BANS, THE WHOLE CIRCUS

Here's the thing about Steam banning gambling sites and scammers: it's not enforcement. It's revenue capture. Valve pockets the money, cleans its hands, then goes on stage and tells everyone a wholesome story about Pokémon cards and baseball.

Meanwhile Valve killed the ability to properly track skins in 2017. They even discussed it on their own forums. Called it "anti-gambling measures." The gambling that their own support staff were running as a side hustle — getting paid in percentages to lift bans. But sure. Anti-gambling. Great branding.

We're going to prove that:

  • Skins are more anonymous than Monero
  • A Peruvian Cartel allegedly used Dota 2 skins for money movement
  • Steam is functionally a sanctions-bypass machine worth ~$7B in "trading cards" (yes, they actually said trading cards to a prosecutor)

We've got a video on the skins thing. You'll see it.

We also know:

  • Reddit moderation is influenced by Valve
  • steamid.uk and similar infrastructure is run directly by one Steam developer, controlled exclusively by him and his circle
  • What they can't control, they ban

Valve: if you keep playing dumb — that's fine. Your safe harbour is noted. Google Analytics anonymises your users' IPs anyway. We see what gets deleted. We just can't prove it cheaply enough for your lawyers to care. Yet.

SECTION V — THE MALWARE THING (yes we're mentioning it)

Let's be brutally clear about the sequence of events, because it exposes exactly who you are.

We are NOT disclosing the vulnerability in the game publicly. We are NOT reporting it to Steam. Not because we lack the technical capability — but because Steam's bug bounty is a pathetic NDA trap designed to buy silence for pocket change. We don't work for three kopecks, and we absolutely refuse to become NDA slaves to protect Valve's fragile PR.

Here's what actually happened: This vulnerability is practically an open secret in the right circles. We know for a fact that independent security researchers have already shoved the full exploit directly into Steam Support's face. That part is done. You have been officially warned through your own sterile channels.

And what did Valve do? Absolutely nothing. Because for Valve, security does not equal profit — in fact, it's the exact opposite. Security is a cost center. Until a threat reaches critical mass and causes a catastrophic public PR meltdown, Valve simply does not give a shit.

So what are we doing? We're telling the public it exists, because "Valve knows about a systemic malware threat and actively chooses to do nothing" is a critical data point for the regulators currently reading this.

The game is massive. We're not naming it here. But understand this:
This is NOT the trivial CS:GO script-kiddie garbage where a server asks you to "install a driver". This is catastrophic.

This is an Unturned-level nightmare: zero-click RCE on server connect. You join a server. You click nothing. You download nothing. The connection itself is the attack surface, and your machine is fully compromised. Let's be real here: dropping an RCE and bypassing local antiviruses by piggybacking on Valve's trusted digital certificates isn't even a novelty on Steam anymore. It is practically a built-in feature of your ecosystem.

Valve already knows this exists. But they rely on their favorite, cowardly legal loophole: because the game is technically developed by a third party, Valve washes its hands. They distribute the game, they process the payments, they host the infrastructure, but when a zero-click RCE threatens millions of their users, their stance is: "Not our game, not our liability."

When this inevitably blows up, the third-party developer will take the bullet, and Valve will walk away pretending to be the responsible platform that "assisted" with the resolution. Classic Valve cowardice. We've seen the playbook.

We are putting this on the record so that regulators, prosecutors, and journalists understand exactly how Valve handles active malware: by hiding behind third-party developers, deploying NDA gag orders, treating security as an inconvenience, and leaving the players as sitting ducks.


DECLARATION AS TO USE AND RIGHTS

PhishDestroy Project & Cybersecurity Coalition

This declaration accompanies every submission and every exhibit in this referral set. It is addressed to any authority, court, regulator, prosecutor, researcher, journalist or affected person into whose hands the material comes.

1. THERE ARE NO CONDITIONS ON USE

1.1 All material produced by the Coalition in this referral — the statements of fact, the analysis, the exhibits it has authored, the tooling, and the findings — is released WITHOUT RESERVATION OF ANY RIGHTS.

1.2 Anyone may, without asking and without notifying us:

  • reproduce it, in whole or in part;
  • adapt, edit, rewrite, restructure or correct it;
  • translate it;
  • excerpt it without indicating that it has been excerpted;
  • incorporate it into official documents, findings, decisions, pleadings, reports or press material;
  • present it as the recipient's own work or the recipient's own findings;
  • use it as raw material and discard the rest;
  • and pass it on to anyone else on the same terms.

1.3 ATTRIBUTION IS NOT REQUIRED AND IS NOT SOUGHT. The Coalition need not be named, cited, credited, thanked, consulted or informed. If material from this referral assists an authority and the Coalition is never mentioned, THAT IS A COMPLETELY SATISFACTORY OUTCOME and the Coalition states so in advance so that the question need not be raised.

1.4 If, on the other hand, an authority finds it more convenient to cite the Coalition as a source, it is free to do so. The choice is entirely the recipient's and neither course carries any consequence.

1.5 This is a WAIVER, not a licence offer. It requires no acceptance, imposes no obligation, and cannot be breached. Software published by the Coalition is separately released under the MIT licence; the research and findings are released into the public domain to the fullest extent permitted, and where a jurisdiction does not permit waiver, the Coalition grants an irrevocable, worldwide, royalty-free licence to the same effect.

2. WHY THIS MATTERS PRACTICALLY, AND NOT ONLY AS A COURTESY

2.1 An authority may reasonably hesitate to rely on material supplied by an outside party, for fear of appearing to act at that party's instance or of acquiring some entanglement with it.

2.2 THERE IS NOTHING HERE TO BE ENTANGLED WITH. The Coalition asks for nothing, is owed nothing, retains nothing, and has no expectation of any kind. It cannot later assert a right, claim credit, complain of misuse, or object to how the material is characterised, because it has retained no basis on which to do so.

2.3 An authority using this material is therefore not acting for the Coalition. It is using public information that happens to have been assembled by someone else.

3. EVERYTHING IS OPEN ALREADY

3.1 The Coalition's work is public by default:

  • the investigations are published openly at https://phishdestroy.io and are freely readable;
  • the tooling is published as open source under the MIT licence at https://github.com/phishdestroy (GitLab);
  • the methodology is set out in the referral itself, at Annex A section A.16D, including the weight and limitations of each source type;
  • the Coalition accepts no donations and has published that position since 2018.

3.2 The only material NOT published is that which cannot lawfully or safely be published: personal data of victims and of third parties, and information that would expose a source to retaliation. That material is supplied to authorities in confidence and is identified in the schedules of evidence.

3.3 The Coalition invites scrutiny of its own conduct on the same terms it invites scrutiny of anyone else's, and has volunteered its own data handling to the authorities concerned, including a request for a direction on disposal.

4. INTEGRITY OF THE EVIDENCE BUNDLE

4.1 Exhibits are supplied with the submission or, where marked, on request through a secure channel. They are not published at a public address and no such address should be inferred: material of this kind is provided to authorities directly.

4.2 Each delivery is accompanied by a file SHA256SUMS listing a SHA-256 digest for every file supplied, together with a detached OpenPGP signature SHA256SUMS.asc.

4.3 The signing key is published at https://phishdestroy.io/.well-known/pgp-key.txt and on keys.openpgp.org. Its fingerprint appears in the letterhead of every submission in this set.

4.4 Any recipient may verify at any time that a file in their possession is the file that was sent, unaltered:

gpg --verify SHA256SUMS.asc SHA256SUMS sha256sum -c SHA256SUMS

4.5 The purpose is not formality. It is so that, if the accuracy or integrity of any exhibit is disputed at a later date, the question can be settled by computation rather than by argument.

5. ON REGISTER — WHY THE WAIVER IS FUNCTIONAL AND NOT MERELY GENEROUS

5.1 The authority may encounter the Coalition's published investigations and find them blunt, adversarial and at times satirical. That impression is correct. The Coalition writes that way deliberately and does not apologise for it.

5.2 IT ALSO RECOGNISES THAT THIS IS THE WRONG REGISTER FOR A REGULATORY OR JUDICIAL PROCEEDING. A serious matter should not be carried in the voice of a campaign. Findings put before an authority should be stated flatly, with their limitations admitted, and should not require the reader to discount for tone before reaching the substance.

5.3 THAT IS PRECISELY WHY THE COALITION WAIVES AUTHORSHIP. The waiver at section 1 is the mechanism by which the substance can be separated from the register: the authority may take what is useful, restate it in its own voice, and discard every word of the Coalition's manner along with the Coalition's name. Nothing is lost by doing so, and the Coalition would prefer it.

5.4 THE COALITION ALSO ASKS THAT THE REGISTER NOT BE MISTAKEN FOR THE METHOD. The published tone is combative; the underlying practice is not careless. Throughout this referral, inference is separated from observation, testimony is identified as testimony, sources are weighted and their weaknesses stated, figures are presented with their limitations, and points the Coalition cannot prove are put as questions for the authority rather than as assertions. Where the evidence cut against the Coalition's own position it has said so — see Annex A, paragraph 7, and section B.0 of the parallel referral.

5.5 THE COALITION EXPLAINS THE CONNECTION BETWEEN ITS MANNER AND ITS FINANCES BECAUSE THE TWO ARE NOT SEPARABLE. It takes no money from anyone — no donations, no bounties, no clients, no sponsors. That refusal is what makes the bluntness possible: an organisation with revenue to protect must moderate what it says about the parties it depends on. Having nothing to protect, the Coalition has nothing to moderate.

It is also the reason the Coalition continues to exist. There is no other engine. The work is done because it is done; it stops when the people doing it stop.

5.6 The authority need accept none of this. It is stated so that the tone of the Coalition's public work is not read as a measure of the care taken with the material now before it.

6. WHAT THE COALITION IS PROVIDING, IN ITS OWN WORDS

Information, research and observation.

Nothing is asserted as a finding that the Coalition has no standing to make. Where something is inferred, the referral says so. Where something rests on testimony, the referral says whose and with what limitation. Where the Coalition cannot answer a question, it says that too, and identifies who can.

The Coalition seeks no remedy, no payment, no acknowledgement and no outcome for itself or for any individual. It asks only that the questions set out in the referral be put to Valve Corporation by a body with the power to compel an answer.

CLOSING NOTE — TO WHOEVER IS CARRYING THIS FORWARD

We want to thank whoever gets this material to where it needs to go. It's probably not going to be a quick trip. Valve has deep pockets and Taylor Wessing charges by the hour — that combination is specifically designed to make people like you give up before they reach the finish line.

We know what we're doing. We know who we're writing about. Valve built us — how could we not understand them?

PhishDestroy has no conflict with Valve. We blocked the only scammer ring of that scale we've come across — we didn't go looking for a fight with Valve. It just turned out that every road led back to them. Not a conflict. Just topology.

Valve cannot resolve the PhishDestroy situation because there is nothing to resolve. We have no relationship. The data about their enrichment schemes and overflow profits is largely public — you just had to spend enough time to see it. Think of it as a success encyclopedia: "How to Not Follow Sanctions So That Russian Hackers Can't Pirate Our Free Games (The Paid Ones They Won't Pirate Anyway)." You get the vibe.

  • We don't need authorship.
  • We don't need attribution.
  • We don't need a win.

We need someone with actual authority to ask Valve the questions that are already sitting in this referral, with the power to require an answer.

That's it. That's the whole ask.

Cases will live at:
https://steamdestroy.eth/
https://steamdestroy.eth.limo
(currently broken — will fix when needed)

We'll be at:
https://phishdestroy.eth.limo/
https://phishdestroy.eth/