Indie game marketplace Itch.io was temporarily disabled following fraud reports from collectible company Funko and its brand protection software, BrandShield. Read on to find out the timeline of the events.
Itch.io Site Was Taken Down
Flagged For "Phishing"
On December 9th, 2AM EST / December 8th, 11PM PST, indie game marketplace website Itch.io was allegedly attacked by Funko’s affiliated "AI Powered Brand Protection Software" called BrandShield, that created a "bogus Phishing report" to Itch.io’s registrar, iwantmyname. Although Itch.io acted quickly by immediately taking down the disputed page that caused the issue, the registrar failed to respond and its automated system disabled the site completely.
The entire Itch.io site was publicly down for several hours, although tech-savvy users were able to access the site by tweaking the host files with the help of Itch.io’s owner, Leaf. Fortunately, the site returned around 5-6AM EST / 2-3AM PST on December 9th.
The timeline of the events was further clarified by Leaf himself on Hacker News; he stated that the disputed page was a Funko Fusion fan page made on Itch.io, containing links to the official site as well as screenshots directly grabbed from the game. The BrandShield software then flagged the particular page as unauthorized usage of the Funko trademark, and thus "sent reports independently to our host and registrar claiming there was ‘fraud and phishing’ going on, likely to cause escalation instead of doing the expected DMCA/cease-and-desist," Leaf shared.
Image from Itch.io, game titled Gridmount by Hempuli Oy
These said reports were then received and viewed on Linode (Itch.io host) and iwantmyname (Itch.io registrar) by Leaf, who proceeded to remove the incriminating page and disabled the said account. He reported his activities to both Linode and iwantmyname, to which the former was the only one who confirmed and closed the case.
According to Leaf, the registrar never even responded to the email. Later on, the Itch.io founder was suddenly alerted when the domain was already shut down. "This evening, I got a downtime alert, and while debugging, I noticed that the domain status had been set to ‘serverHold’ on iwantmyname's domain panel. We have no other abuse reports from iwantmyname other than this one. I'm assuming no one on their end ‘closed’ the ticket, so it went into an automatic system to disable the domain after some number of days. I've been trying to get in touch with them via their abuse and support emails, but no response likely due to the time of day, so I decided to ‘escalate’ the issue myself on social media."
In response to the statements made on Itch.io’s official social media accounts about the issue, Funko has reportedly even called up the owner’s own family member. Leaf posted on Itch.io’s X (Twitter) a screenshot of a text message from his mother, who got a "strange call from a company about accusatory statements on your social media account."
However, as of writing, Funko themselves have not publicly commented on the accusations made.
BrandShield, the brand protection software has also addressed the issue on their official X (Twitter) account, explaining that "We identified and reported the infringement, and requested a takedown of the URL in question – not of the entire http://itch.io domain. The temporary takedown of the website was a decision made by the service providers, not BrandShield."
Source:
Itch.io Official X (Twitter)
Leaf’s Statement on Hacker News
