Funko inadvertently disables itch.io’s whole website, blames third-party brand protection

Indie games platform, itch.io, suffered an extended downtime on December 9. In a tweet, it blamed toy giant, Funko. The company behind Funko Pop's ubiquitous black-eyed simulacra has since confirmed that it—or at least a partnered company protecting its brands—triggered the takedown.

The tweet from itch.io alleged that “some trash ‘AI Powered’ Brand Protection Software” owned by a company called BrandShield had flagged a webpage on itch.io’s domain and then delivered “some bogus Phishing report” to domain registrar, iwantmyname.com. In response, the registrar allegedly disabled the domain through an automated process.

This resulted in anyone visiting the site to purchase or download games instead meeting a blunt “This site can’t be reached” message. The offending page, which seemed to be a fan-made page for the official Funko Fusion video game, has been removed alongside the author’s itch.io profile. Leaf Corcoran, founder of the company, posted some context on Y Combinator’s Hacker News later that day, saying:

From what I can tell, some person made a fan page for an existing Funko Pop video game (Funko Fusion), with links to the official site and screenshots of the game. The BrandShield software is probably instructed to eradicate all "unauthorized" use of their trademark, so they sent reports independently to our host and registrar claiming there was "fraud and phishing" going on, likely to cause escalation instead of doing the expected DMCA/cease-and-desist. Because of this, I honestly think they're the malicious actor in all of this. Their website, if you care: https://www.brandshield.com/

About 5 or 6 days ago, I received these reports on our host (Linode) and from our registrar (iwantmyname). I expressed my disappointment in my responses to both of them but told them I had removed the page and disabled the account. Linode confirmed and closed the case. iwantmyname never responded. This evening, I got a downtime alert, and while debugging, I noticed that the domain status had been set to "serverHold" on iwantmyname's domain panel. We have no other abuse reports from iwantmyname other than this one. I'm assuming no one on their end "closed" the ticket, so it went into an automatic system to disable the domain after some number of days.

I've been trying to get in touch with them via their abuse and support emails, but no response likely due to the time of day, so I decided to "escalate" the issue myself on social media.

Itch.io’s downtime lasted several hours before returning to full capacity, the domain issues apparently resolved. For its part, Funko claims innocence. The massive collectibles producer tweeted a statement around 5:00 pm CST saying that the AI-generated report was indeed the work of their “brand protection partners” and not a direct order from Funko staff. As others have pointed out, the statement mistakenly calls the phishing report a “takedown request”. The particulars fall into the realm of technical specificity, but a corporation with a legal team certainly should understand the difference before making a public mea culpa:

At Funko, we hold a deep respect and appreciation for indie games, indie gamers, and indie developers. We’re fans of fans, and we love the creativity and passion that define the indie gaming community.

Recently, one of our brand protection partners identified a page on http://itch.io imitating the Funko Fusion development website. A takedown request was issued to address this specific page. Funko did not request a takedown of the @itchio platform, and we’re happy the site was back up by this morning.

We have reached out to @itchio to engage with them on this issue and we deeply appreciate the understanding of the gaming community as the details are determined. Thank you for sharing in our passion for creativity.

If you thought this story wasn't weird enough, add to it Corcoran’s alleged claim that Funko—or at least an entity representing their interest—called their mother to inquire about “accusatory statements” on the founder’s social media. Rascal has reached out to both itch.io and Funko for comment. The former has not responded, while the latter simply repeated the text of Funko’s tweet.

This isn’t the first time that itch.io suddenly made news this year. Every’s Gareth Edwards reported in October that the British Government’s ceding of sovereignty over the Chagos Islands could have legal consequences for every website using the “.io” domain. Since then, there has been no update on whether the .io domain will continue or not. For now, it seems like itch has no plans to change.