# The Steam Dossier: rules, routes and accountability

> Public forensic investigation of Steam OpenID authentication, Valve enforcement, account data access and the market-ceiling economy.

Canonical: https://phishdestroy.io/steam_dossier/
Language: en
Author: PhishDestroy Team
Publisher: PhishDestroy

## Reading

- [Published page](https://phishdestroy.io/steam_dossier/)
- [Complete Markdown](https://phishdestroy.io/steam_dossier/index.html.md)
- [Complete plain text](https://phishdestroy.io/steam_dossier/index/llms-full.txt)
- [Investigation index](https://phishdestroy.io/steam_dossier/llms.txt)

## Sections

- [The rule. The record. The unanswered questions.](https://phishdestroy.io/steam_dossier/#briefing-heading)
- [Contents](https://phishdestroy.io/steam_dossier/#toc)
- [Open letter to the Washington State Gambling Commission](https://phishdestroy.io/steam_dossier/#wsgc-public-address)
- [Ten days became ten years. Reopen the record.](https://phishdestroy.io/steam_dossier/#wsgc-public-address-title)
- [The site is blocked. The login route is not.](https://phishdestroy.io/steam_dossier/#proxy-bypass-explainer)
- [Figure 3.1 — The two routes, drawn.](https://phishdestroy.io/steam_dossier/#proxy-bypass-explainer)
- [The Big Picture Trap: Link Filter is Compliance Theater, Not a Shield](https://phishdestroy.io/steam_dossier/#linkfilter-coverage)
- [A blocked main domain paired with an unblocked auth host leaves the login route open — and it stays open for years.](https://phishdestroy.io/steam_dossier/#proxy-bypass-explainer)
- [Background: What Steam Is and Why It Matters Here](https://phishdestroy.io/steam_dossier/#proxy-bypass-explainer)
- [What Valve Did: The Domain Block](https://phishdestroy.io/steam_dossier/#proxy-bypass-explainer)
- [What a Proxy Domain Is](https://phishdestroy.io/steam_dossier/#proxy-bypass-explainer)
- [The Critical Point: The Auth Host Is Sent to Steam in Every Request](https://phishdestroy.io/steam_dossier/#proxy-bypass-explainer)
- [What This Proves](https://phishdestroy.io/steam_dossier/#proxy-bypass-explainer)
- [Inside Steam, Valve's list is the only list.](https://phishdestroy.io/steam_dossier/#inside-steam-filter)
- [Link filter protection bypass](https://phishdestroy.io/steam_dossier/#inside-steam-filter)
- [Big Picture web browser leaks login cookies and discloses sensitive information (may lead to account takeover)](https://phishdestroy.io/steam_dossier/#inside-steam-filter)
- [What this means for a minor with an antivirus installed](https://phishdestroy.io/steam_dossier/#inside-steam-filter)
- [An endpoint closed. Public tracing lost a key.](https://phishdestroy.io/steam_dossier/#evidence-blackout)
- [The Pre-Blackout Era](https://phishdestroy.io/steam_dossier/#evidence-blackout)
- [After the change](https://phishdestroy.io/steam_dossier/#evidence-blackout)
- [One session. More access than the user sees.](https://phishdestroy.io/steam_dossier/#vulnerability-profile)
- [1. Insufficient Step-up Authentication](https://phishdestroy.io/steam_dossier/#vulnerability-profile)
- [2. Lack of Principle of Least Privilege](https://phishdestroy.io/steam_dossier/#vulnerability-profile)
- [3. Broken Session Management](https://phishdestroy.io/steam_dossier/#vulnerability-profile)
- [4. Domain-Level Blocking of Auth Hosts Was Technically Feasible](https://phishdestroy.io/steam_dossier/#vulnerability-profile)
- [Valve builds against these rules every day. It did not build to them here.](https://phishdestroy.io/steam_dossier/#integration-paradox-title)
- [Interactive Exploit & Hijack Simulator](https://phishdestroy.io/steam_dossier/#hijack-simulation)
- [The endpoints behind the sequence.](https://phishdestroy.io/steam_dossier/#api-reference)
- [A checked box. Whose action?](https://phishdestroy.io/steam_dossier/#consent-analysis)
- [How Valve Finally Neutralized "Trade Substitution" — And Why It Took 7 Years of Workarounds](https://phishdestroy.io/steam_dossier/#autopsy-trade-substitution)
- [Their rulebook. The recorded platforms.](https://phishdestroy.io/steam_dossier/#selective-enforcement)
- [One rulebook. Unequal enforcement.](https://phishdestroy.io/steam_dossier/#enforcement-focus-title)
- [An automation API. A rule against automation.](https://phishdestroy.io/steam_dossier/#api-paradox)
- [The "Game Developer" Fallacy](https://phishdestroy.io/steam_dossier/#api-paradox)
- [Ten days demanded. Ten years to account for.](https://phishdestroy.io/steam_dossier/#case-study-section)
- [VALVE CORPORATION](https://phishdestroy.io/steam_dossier/#letter-company)
- [Follow the declared return host.](https://phishdestroy.io/steam_dossier/#csgofast-scale)
- [Two deadlines. One unanswered enforcement standard.](https://phishdestroy.io/steam_dossier/#washington-record-heading)
- [The 10-Day Notice Decade: Forensic Survival Audit of the 23 Named Sites](https://phishdestroy.io/steam_dossier/#cd-survival-audit)
- [The hostname is already in the request.](https://phishdestroy.io/steam_dossier/#autoban-feasibility-section)
- [Documented and reported precedents](https://phishdestroy.io/steam_dossier/#autoban-feasibility-section)
- [What a registration date does and does not show](https://phishdestroy.io/steam_dossier/#autoban-feasibility-section)
- [Comparative Audit: API Compliance Standards](https://phishdestroy.io/steam_dossier/#autoban-feasibility-section)
- [The off-Steam price gap](https://phishdestroy.io/steam_dossier/#market-thesis-heading)
- [What the dollar figure shows](https://phishdestroy.io/steam_dossier/#market-gap-section)
- [Many venues list more dollar value than Steam.](https://phishdestroy.io/steam_dossier/#market-chart-value)
- [Steam still leads in number of offers.](https://phishdestroy.io/steam_dossier/#market-chart-offers)
- [The commercial ecosystem is in plain sight.](https://phishdestroy.io/steam_dossier/#market-gap-section)
- [Who can reset the safeguards?](https://phishdestroy.io/steam_dossier/#insider-threat)
- [A recovery ticket that disabled the account's security, and a reported $10,000 loss](https://phishdestroy.io/steam_dossier/#insider-threat)
- [Beyond the inventory.](https://phishdestroy.io/steam_dossier/#insider-threat)
- [Valve admitted the door twice, thirty-three months apart. It never closed.](https://phishdestroy.io/steam_dossier/#theft-ledger-title)
- [Confidentiality must come with technical accountability.](https://phishdestroy.io/steam_dossier/#insider-threat)
- [Follow the money. Separate the transactions.](https://phishdestroy.io/steam_dossier/#aml-kyc)
- [Where the money actually moves.](https://phishdestroy.io/steam_dossier/#revenue-path)
- [Classify the activity, then the obligation.](https://phishdestroy.io/steam_dossier/#aml-kyc)
- [Trace proceeds, knowledge and assistance.](https://phishdestroy.io/steam_dossier/#aml-kyc)
- [The Digital Services Act: put knowledge on the record](https://phishdestroy.io/steam_dossier/#dsa-accountability)
- [A ten-day demand.](https://phishdestroy.io/steam_dossier/#dsa-accountability)
- [The DSA time window.](https://phishdestroy.io/steam_dossier/#dsa-accountability)
- [Duration needs a notice trail.](https://phishdestroy.io/steam_dossier/#dsa-accountability)
- [of annual worldwide turnover](https://phishdestroy.io/steam_dossier/#dsa-accountability)
- [Minors: a Steam login is not an age check](https://phishdestroy.io/steam_dossier/#minors-protection)
- [Identify the operator and the data.](https://phishdestroy.io/steam_dossier/#minors-protection)
- [Record the journey from login to deposit.](https://phishdestroy.io/steam_dossier/#minors-protection)
- [The request. The reply. The missing comparison.](https://phishdestroy.io/steam_dossier/#gdpr-live-case)
- [The records exist; the data subject did not receive them.](https://phishdestroy.io/steam_dossier/#gdpr-live-case)
- [The Subscriber Agreement against the platform's own architecture](https://phishdestroy.io/steam_dossier/#tos-structural-void)
- [The Market ceiling and the commercial-use prohibition](https://phishdestroy.io/steam_dossier/#tos-structural-void)
- [The API-key vulnerability as a platform design question rather than user negligence](https://phishdestroy.io/steam_dossier/#tos-structural-void)
- [Valve receives the auth hostname on every login](https://phishdestroy.io/steam_dossier/#tos-structural-void)
- [The pattern in the archived complaints](https://phishdestroy.io/steam_dossier/#tos-structural-void)
- [A court evaluating this record would not read the SSA in isolation.](https://phishdestroy.io/steam_dossier/#tos-structural-void)
- [The findings. The records we ask for.](https://phishdestroy.io/steam_dossier/#findings-and-requests)
- [Evidence Memorandum — material provided by Source 1](https://phishdestroy.io/steam_dossier/#official-memorandum)
- [The redaction in the produced PDF is cosmetic: the covered text remains extractable](https://phishdestroy.io/steam_dossier/#academic-response)
- [Support and Legal Correspondence Exhibits](https://phishdestroy.io/steam_dossier/#exhibit-gallery-section)
- [Selected primary records](https://phishdestroy.io/steam_dossier/#evidence-matrix-section)
- [Hardware keys, requested in 2016](https://phishdestroy.io/steam_dossier/#receipt-heading-gh-01)
- [Crash reports without an effective opt-out](https://phishdestroy.io/steam_dossier/#receipt-heading-gh-02)
- [Auth-ticket abuse reported to Valve](https://phishdestroy.io/steam_dossier/#receipt-heading-gh-03)
- [44 disputed Market purchases](https://phishdestroy.io/steam_dossier/#receipt-heading-rd-01)
- [A permanent ban and closed appeals](https://phishdestroy.io/steam_dossier/#receipt-heading-rd-02)
- [A recovery reset and a reported $10,000 loss](https://phishdestroy.io/steam_dossier/#receipt-heading-rd-03)
- [ArchiSteamFarm and the automation clause](https://phishdestroy.io/steam_dossier/#asf-case-study)
- [Choose a rule. Inspect the matching records.](https://phishdestroy.io/steam_dossier/#legal-ledger-workspace-section)
- [DSAR playbook: request the evidence](https://phishdestroy.io/steam_dossier/#dsar-playbook)
- [Preserve your timeline.](https://phishdestroy.io/steam_dossier/#dsar-playbook)
- [Request your retained data.](https://phishdestroy.io/steam_dossier/#dsar-playbook)
- [Keep the delivery record.](https://phishdestroy.io/steam_dossier/#dsar-playbook)
- [Compare the response.](https://phishdestroy.io/steam_dossier/#dsar-playbook)
- [Account security & access records](https://phishdestroy.io/steam_dossier/#dsar-playbook)
- [A discrepancy is evidence to investigate.](https://phishdestroy.io/steam_dossier/#dsar-playbook)
- [Support volume. Published response times.](https://phishdestroy.io/steam_dossier/#support-stats-section)
- [Two queues at one support desk, read across 21 archived captures.](https://phishdestroy.io/steam_dossier/#support-stats-section)
- [Count the records. Check the scope.](https://phishdestroy.io/steam_dossier/#evidence-base)
- [Valve publishes no enforcement record. We built one.](https://phishdestroy.io/steam_dossier/#phishdestroy-manifesto)

## Evidence and downloads

- [auth-route-audit.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit.json)
- [Compare saved Steam Link Filter results ↗](https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-all-results.json)
- [rollbit.com.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rollbit.com.json)
- [skin.club.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skin.club.json)
- [howl.gg.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/howl.gg.json)
- [duelbits.com.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/duelbits.com.json)
- [Dossier Auth Audit ↗](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgofast.com.json)
- [farmskins.com.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/farmskins.com.json)
- [cobaltlab.tech.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/cobaltlab.tech.json)
- [csgo.net.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgo.net.json)
- [ggdrop.com.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/ggdrop.com.json)
- [rustchance.com.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rustchance.com.json)
- [skin.fans.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skin.fans.json)
- [skinport.com.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinport.com.json)
- [skins.cash.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skins.cash.json)
- [tf2hunt.com.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tf2hunt.com.json)
- [linkfilter-2026-09-22.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-2026-09-22.json)
- [csgoempire.com.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csgoempire.com.json)
- [cs.money.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/cs.money.json)
- [csfloat.com.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/csfloat.com.json)
- [g4skins.com.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/g4skins.com.json)
- [juice.gg.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/juice.gg.json)
- [market.csgo.com.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/market.csgo.com.json)
- [rust.tm.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/rust.tm.json)
- [skinbaron.de.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/skinbaron.de.json)
- [tf2royal.com.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tf2royal.com.json)
- [tradeit.gg.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/tradeit.gg.json)
- [upgrader.pro.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/upgrader.pro.json)
- [linkfilter-recheck-2026-09-21.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-recheck-2026-09-21.json)
- [domain-registration.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/domain-registration.json)
- [wayback-snapshots.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/wayback-snapshots.json)
- [linkfilter-2026-09-22c.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-2026-09-22c.json)
- [master_registry.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/master_registry.json)
- [longitudinal-steam-phishing-audit.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/longitudinal-steam-phishing-audit.json)
- [linkfilter-steam-phishing-100.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-steam-phishing-100.json)
- [linkfilter-coverage-2026-09-22.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-coverage-2026-09-22.json)
- [platform-audit.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/platform-audit.json)
- [platforms-removed.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/platforms-removed.json)
- [hackerone-reports.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/hackerone-reports.json)
- [PCI SSC resource guide ↗](https://listings.pcisecuritystandards.org/pdfs/PCI_DSS_Resource_Guide_(003).pdf)
- [WSGC Legislative Report PDF (Local Copy) ↗](https://phishdestroy.io/steam_dossier/steam_tos_assets/wsgc-skins-gambling-briefing-2018.pdf)
- [the same file on wsgc.wa.gov ↗](https://wsgc.wa.gov/sites/default/files/2023-10/Skins%20Gambling.pdf)
- [retrieval record & hash ↗](https://phishdestroy.io/steam_dossier/steam_tos_assets/wsgc-briefing-manifest.json)
- [Earlier CSFloat snapshot ↗](https://phishdestroy.io/steam_dossier/steam_tos_assets/csfloat-catalogue.json)
- [dated 39-row extraction ↗](https://phishdestroy.io/steam_dossier/steam_tos_assets/priceempire-marketplaces.json)
- [Five-marketplace atlas dataset ↗](https://phishdestroy.io/steam_dossier/steam_tos_assets/cs2sh-atlas.json)
- [Provenance manifest ↗](https://phishdestroy.io/steam_dossier/steam_tos_assets/cs2sh-manifest.json)
- [Skinport snapshot ↗](https://phishdestroy.io/steam_dossier/steam_tos_assets/skinport-floor-over-cap.json)
- [source rows & hashes ↓](https://phishdestroy.io/steam_dossier/steam_tos_assets/outsourcing-archive-records.json)
- [FinCEN FIN-2019-G001, §§ 1–2, 5.1 ↗](https://www.fincen.gov/sites/default/files/2019-05/FinCEN%20CVC%20Guidance%20FINAL.pdf)
- [archived 2025-07-11 ↗](https://web.archive.org/web/20250711185007/https://www.fincen.gov/sites/default/files/2019-05/FinCEN%20CVC%20Guidance%20FINAL.pdf)
- [screenshot-manifest.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/screenshot-manifest.json)
- [page-level PDF measurements and method ↗](https://phishdestroy.io/steam_dossier/steam_tos_assets/regulatory-review/disclosure-audit.json)
- [Download the six records ↓](https://phishdestroy.io/steam_dossier/steam_tos_assets/selected-evidence-records.json)
- [Searchable archive manifest ↗](https://phishdestroy.io/steam_dossier/steam_tos_assets/archive_manifest.json)
- [database.json](https://phishdestroy.io/steam_dossier/steam_tos_assets/database.json)
- [EDPB access guidelines, §§ 2, 4–6 ↗](https://www.edpb.europa.eu/system/files/2023-04/edpb_guidelines_202201_data_subject_rights_access_v2_en.pdf)
- [Download .txt ↓](https://phishdestroy.io/steam_dossier/steam_tos_assets/dsar-request-template.txt)
- [Listing measurements and hashes ↗](https://phishdestroy.io/steam_dossier/steam_tos_assets/part2-measurements.json)
- [Master CSV ↗](https://phishdestroy.io/steam_dossier/VALVE_EVIDENCE_PACK/databases/TOTAL_VALVE_SCANDALS_MASTER_DB.csv)