Itch.io Blames Funko for Taking Down Its Website Due to Phishing Report

Key insights

4 slides

The Trigger

An automated phishing report from BrandShield caused the outage.

BrandShield, an AI-powered brand protection software used by Funko, generated the report. This report targeted a user-created fan page on itch.io.

Automated Action

The registrar's automated system disabled the domain despite content removal.

Itch.io had already removed the disputed content upon receiving initial notice.

It was like a security system continuing to sound an alarm even after the intruder had left, because no one manually reset…

Process Flaw. The registrar's automated system disabled the domain because an open support ticket was not manually closed, despite content removal.

1 / 4

Ask AI about this article

Summary

On December 9, 2024, the indie game storefront itch.io experienced a global service outage after its domain registrar, iwantmyname, disabled the platform’s domain. The disruption stemmed from a phishing report filed by BrandShield, an AI-powered brand protection service employed by the collectibles manufacturer Funko. The report targeted a user-created fan page on itch.io related to the game Funko Fusion, alleging trademark infringement and fraudulent activity.

The incident highlights significant flaws in automated brand protection workflows. Although itch.io had proactively removed the disputed content upon receiving initial notices, the registrar’s automated systems proceeded to disable the domain because the support ticket remained open on their end. While the hosting provider, Linode, closed the case after receiving confirmation of the content's removal, the lack of human oversight at the registrar level led to the site's suspension.

The platform’s founder, Leaf Corcoran, characterized the automated reporting process as overly aggressive, noting that the software likely prioritized the eradication of unauthorized trademark usage over standard legal procedures like DMCA takedowns or cease-and-desist notices. The domain was eventually reinstated following further communication between the parties. As of the conclusion of the event, Funko has not issued an official statement regarding the actions of its third-party software provider, and no further legal action has been announced by the affected platform.