So, let's talk a bit about key scammers, and the business of reselling free review keys for #steam indies through so-called "grey marketplaces". Thread (:
As an indie dev, you'll receive hundreds of emails like this one. "Hi, I'm a big Youtubeur, I want to advertise your incredible %game_name% for free, please send me 10 keys for me and my numerous followers." 
As most scams, they're short, unprofessional-looking emails in approximate English. Most developers will immediately weed them out. But the scammers aren't nearly as unprofessional as they appear.
Most Youtubers set a friendly name to their Youtube URL, like "florencemachine", "screenjunkies" or "destinygame". Our Youtuber youtube.com/user/eowjdfuds… apparently didn't care for it, which isn't shocking since it's just an URL...
But who picks eowjdfudshrghk@gmail.com as a professional email address ? An email address needs to be readable. Unfortunately, our Youtuber here didn't put an official business email on his Youtube profile that we could verify...
The email itself featured a hidden tracker in the form of an invisible image, courtesy of the Russian @deskun_app service. I'm not so sure this is GDPR-compliant, but I'll let it slide.
Of course, looking at my emails, I found other messages from different addresses using the same tracking service, the same wording, the same username pattern with high-profile Youtubers who don't provide an official business email.
Obviously, these email addresses are registered and used by the same bot. A single scammer is impersonating multiple public figures, requesting review keys of every Steam game, over and over, through each account.
Now you might be thinking, "Gwennaël, are you really sure it's a scam ? What if it's all a huge coincidence ?" Well, I went ahead and enthusiastically answered the email with a review key...
...And then, half an hour later, I bought my own game on @kinguinnet, which didn't had available keys before. Lo and behold :
My Helium Rain key was somehow revoked by the developer, so I filed for a refund. I doubt I'm going to get one, but after all, Kinguin touts itself a legitimate business with great customer service.
Who's that Zefir seller Kinguin is talking about ? Let's google it and scroll down just a tiny bit to see just how many keys this guy is selling. It's massive. Hundreds or thousands. Only indies games, too - this huge seller somehow doesn't get publisher business.
Now you usually get a customer review for about every 50 units sold, according to our research. So I'm estimating Zefir sold some 40,000 review keys since 2014. I don't have his financials, but selling ~$10 games he didn't bought can't be bad business.
Based on his user profile picture, he's probably also behind these other very legitimate-looking sellers (these are all of the Google Images hits when searching for the image).
Given the short delay before the key went on sale, I'm also willing to guess that publishing keys to Kinguin can be automated, so that money just flows in automatically, with none of it going to developers. However, @kinguinnet does make 11% of that.
This has been covered before by @jasonschreier at Kotaku (kotaku.com/people-keep-tr…) and game devs who denounced G2A & Kinguin as crucial supporters of this business. Regardless, this problem is only growing, with even more indies on Steam every day.
We also get plenty of review requests from very small sites with zero comments and loads of generic articles. I haven't answered any of these, so I can't say if they're scams or sincere attempts at building the next IGN.
Developers : never sell any Steam key directly if you want to avoid it, and assume all emails are scams, especially from big Youtubers. Use Steam's Curator Connect tool. Beware of entering bundles or selling keys directly on your own site, too, as those have been abused before.
As to gamers, if you care about where your money goes, you should favor legitimate storefronts such as Steam, GOG, Itch, Discord, and the publisher / developer stores. Aren't indies cheap enough already ?
UPDATE : the merchant page was removed from G2play, though sibling are still up. I suspect it's really the same seller. @KinguinNet also removed all keys for our title.
PS - Well, this is apparently a legitimate Korean name written as in English, so it might actually be perfectly readable to some !
This is how @KinguinNet suggests indies handle the issue - same strategy as @G2A_com. Give them your business willingly, and you get exclusivity. Scammers won't be able to sell review keys and players won't be able to sell surplus bundle keys.
Kinguin isn't in the business of letting players resell the two legitimate bundle keys they didn't use. They'll drop players immediately from their store, should devs want to sell directly at full price. They couldn't care less about legit players because it's not their business.
@KinguinNet has not banned any of the secondary vendors as of today, despite the obvious pattern in name & profile pic. They are still selling hundreds of games. Hundreds of other scammers.
This kind of blew up, so I'd like to tell other indies this : look for your games on @KinguinNet and @G2A_com, and ask them to remove the sellers from their store. They say they take fraud seriously, but won't act unless you publicly denounce the seller accounts.
