# Request for review: possible abuse of the Counter-Strike: Source server list

Observed at: 2026-10-18T17:39:41Z

Public evidence page: https://css.zuola.com/server-list-watch/

## Summary

Using Valve's server-list response for Counter-Strike: Source (App ID 240), a dedicated name filter for *SGaming.RU*, and direct A2S_INFO verification, this observation found 13531 matching endpoints concentrated on 50 public IP addresses. 13490 endpoints answered direct A2S_INFO verification; 41 did not answer during this observation. The dedicated name query returned 10000 entries. Because the dedicated name query returned 10,000 entries, this should be read as an observed lower bound rather than a complete count.

Among the direct responses, 3065 endpoints advertised a capacity of at least 128 players and 3053 reported exactly 255 current players. These patterns are investigation leads, not by themselves proof that any operator violated Steam policy.

Evidence SHA-256 (canonical observations array): 653ad8e1ab8656a605a9c83a6448c6f2ccfe3c99a324966bddf4107320f47bbf

## IP concentration

| IP address | Matching endpoints | Directly verified | Capacity >=128 | Reporting 255 players | Query-port range |
|---|---:|---:|---:|---:|---:|
| 79.108.161.48 | 400 | 400 | 104 | 104 | 10000-10718 |
| 94.159.116.64 | 380 | 380 | 89 | 89 | 10000-12012 |
| 95.170.124.142 | 379 | 379 | 81 | 81 | 10009-12010 |
| 45.153.68.222 | 378 | 378 | 84 | 84 | 10001-12012 |
| 193.124.121.168 | 371 | 370 | 78 | 78 | 10002-11223 |
| 2.56.204.132 | 368 | 368 | 76 | 76 | 10003-11223 |
| 45.153.230.151 | 365 | 363 | 93 | 93 | 10003-11217 |
| 170.168.15.11 | 363 | 363 | 80 | 80 | 10002-11223 |
| 80.90.182.187 | 363 | 363 | 83 | 83 | 10006-11221 |
| 194.87.168.49 | 357 | 357 | 82 | 82 | 10000-10935 |
| 213.165.61.45 | 357 | 353 | 92 | 91 | 10000-10934 |
| 31.56.240.189 | 349 | 337 | 82 | 78 | 10001-10716 |
| 45.130.166.33 | 348 | 348 | 80 | 80 | 10002-10718 |
| 86.107.100.178 | 346 | 346 | 76 | 76 | 10002-10717 |
| 193.24.233.114 | 345 | 345 | 89 | 89 | 10001-10718 |
| 92.38.130.240 | 343 | 343 | 75 | 75 | 10000-10719 |
| 146.185.196.17 | 342 | 342 | 81 | 81 | 10000-10718 |
| 188.240.213.212 | 342 | 342 | 80 | 80 | 10000-10719 |
| 5.101.218.188 | 342 | 342 | 73 | 73 | 10000-10716 |
| 63.250.61.102 | 342 | 342 | 69 | 69 | 10001-10718 |
| 103.252.117.148 | 340 | 340 | 73 | 73 | 10000-10719 |
| 74.113.235.142 | 339 | 339 | 80 | 80 | 10005-10718 |
| 5.189.201.24 | 338 | 338 | 75 | 75 | 10000-10716 |
| 41.196.0.191 | 334 | 330 | 70 | 70 | 10001-10719 |
| 103.90.162.131 | 200 | 200 | 43 | 43 | 10005-10719 |
| 138.128.243.249 | 200 | 200 | 43 | 43 | 10000-10715 |
| 146.185.197.35 | 200 | 197 | 43 | 43 | 10005-10713 |
| 185.158.114.143 | 200 | 200 | 56 | 56 | 10002-12086 |
| 185.248.100.98 | 200 | 200 | 35 | 35 | 10011-12003 |
| 185.40.78.228 | 200 | 199 | 54 | 54 | 10000-11215 |
| 185.72.8.91 | 200 | 200 | 48 | 48 | 10003-10711 |
| 193.19.119.97 | 200 | 200 | 42 | 42 | 10000-12007 |
| 194.38.8.138 | 200 | 200 | 53 | 53 | 10000-11727 |
| 194.87.245.146 | 200 | 200 | 44 | 44 | 10000-10717 |
| 194.87.9.74 | 200 | 196 | 45 | 44 | 10001-10934 |
| 195.62.52.237 | 200 | 200 | 44 | 44 | 10006-12014 |
| 212.113.120.63 | 200 | 200 | 37 | 37 | 10002-10923 |
| 31.130.138.65 | 200 | 199 | 44 | 43 | 10001-11077 |
| 37.220.86.31 | 200 | 199 | 39 | 39 | 10001-12012 |
| 45.89.190.236 | 200 | 200 | 44 | 44 | 10008-11711 |
| 5.252.193.7 | 200 | 200 | 51 | 51 | 10012-11982 |
| 66.55.76.68 | 200 | 200 | 49 | 49 | 10001-10714 |
| 77.222.35.189 | 200 | 197 | 38 | 35 | 10001-12010 |
| 80.66.65.249 | 200 | 200 | 49 | 49 | 10005-12006 |
| 81.200.144.48 | 200 | 199 | 37 | 37 | 10007-12009 |
| 85.238.112.45 | 200 | 200 | 49 | 49 | 10002-10715 |
| 89.111.143.185 | 200 | 200 | 44 | 44 | 10002-12576 |
| 91.219.149.43 | 200 | 200 | 46 | 46 | 10009-14846 |
| 194.117.80.55 | 192 | 188 | 43 | 41 | 10001-10932 |
| 46.174.50.174 | 8 | 8 | 0 | 0 | 27015-27041 |

## Reproduction and attachments

1. Refresh the unfiltered Internet server list in Counter-Strike: Source and search names for SGaming.RU.
2. Compare the returned endpoints with the attached full CSV or raw JSON.
3. Send A2S_INFO to the query addresses and compare name, App ID, map, players and capacity.
4. Use the IP-summary CSV to review concentration by public IP.
5. Please compare these observations with Valve's master-server registration, game-server account, redirection and connection telemetry.

Attachments available from the public evidence page:

- sgaming-ip-summary.csv
- sgaming-css-observations.csv
- sgaming-css-observations.json

The raw JSON preserves the Valve-returned metadata fields under each observation's steam object and records the separate direct A2S result. It contains no Steam Web API key and no player names.

## Requested review

- Determine whether one operator or related accounts are registering disproportionate duplicate or misleading entries.
- Validate advertised player counts and endpoint identity against Valve-side connection telemetry.
- Consider collapsing repeated public IPs by default while allowing users to expand legitimate distinct ports.
- Rate-limit abnormal registration volume by server account and network, with an appeal path for legitimate operators.
- Remove or down-rank entries whose advertised endpoint, game identity or player count repeatedly fails validation.

Valve documentation references:

- Steamworks Web API server methods: https://partner.steamgames.com/doc/webapi/ISteamApps
- Steam Support: https://help.steampowered.com/