[leafo]

I'm the one running itch.io, so here's some more context for you:

From what I can tell, some person made a fan page for an existing Funko Pop video game (Funko Fusion), with links to the official site and screenshots of the game. The BrandShield software is probably instructed to eradicate all "unauthorized" use of their trademark, so they sent reports independently to our host and registrar claiming there was "fraud and phishing" going on, likely to cause escalation instead of doing the expected DMCA/cease-and-desist. Because of this, I honestly think they're the malicious actor in all of this. Their website, if you care: https://www.brandshield.com/

About 5 or 6 days ago, I received these reports on our host (Linode) and from our registrar (iwantmyname). I expressed my disappointment in my responses to both of them but told them I had removed the page and disabled the account. Linode confirmed and closed the case. iwantmyname never responded. This evening, I got a downtime alert, and while debugging, I noticed that the domain status had been set to "serverHold" on iwantmyname's domain panel. We have no other abuse reports from iwantmyname other than this one. I'm assuming no one on their end "closed" the ticket, so it went into an automatic system to disable the domain after some number of days.

I've been trying to get in touch with them via their abuse and support emails, but no response likely due to the time of day, so I decided to "escalate" the issue myself on social media.

[vasco]

Hope you have money to fight them. I stuck to my guns on a wrongful one like this and while Digitalocean and Cloudflare both had my backs (surprisingly before I even asked, both of them got a lot of good will on that - they informed me they already checked and it was spurious!). Google didn't have my back though and immediately caved when they upgraded their sham copyright infringement claim to money laundering and fraud based on nothing - a fully static website with no backend calls. Good luck! I still have the sites exactly as they were just to spite them and will keep running them at a loss until I'm dead. Copyright infringement my ass. This abuse has got to stop sometime.

[latexr]

> I still have the sites exactly as they were just to spite them and will keep running them at a loss until I'm dead.

https://en.wikipedia.org/wiki/Spite_house

https://en.wikipedia.org/wiki/List_of_Curb_Your_Enthusiasm_e...

[joseda-hg]

If they are fully static couldn't they probably be run at close to 0 cost from you?

[pabs3]

What are the sites called? Would like to get them saved to archive.org :)

[RestartKernel]

This issue aside, thanks for doing what you do. I was kind of expecting Itch to get sold to some holdings or casino company at some point, as good things tend to go, but I've been happily surprised to see it mature independently throughout the years.

[Tepix]

I agree itch.io is awesome!

Edit: And i'm happy to see that it's working again as of 2024-12-09 12:27 UTC+1

[TheEnbyperor]

I run a domain registrar. "serverHold" is not a status that iwantmyname could've set. If they had suspended the domain it'd have "clientHold" set. Server Hold means the registry (i.e. .io directly) has suspended the domain. Your best bet would be to contact the Internet Computer Bureau Ltd who run .io at [e-mail], or the registry technical support provider Identity Digital at [e-mail].

[leafo]

Interesting, this morning I got a response from a staff member of the parent company that owns iwantmyname saying they didn't get my response with regards to the abuse notification they sent and that's why they took the domain down.

[kj4ips]

I've heard a ton of stories about .io, IMO, they play fast and loose in a space where that isn't okay, and they get away with it mostly because they are a ccTLD.

The last time someone I knew had an issue, they had to get a senator to make waves to get anything resolved.

[apitman]

What registrar do you run?

[duggan]

iwantmyname was bought out by a conglomerate, “Team Internet[1]”, a few years ago.

Prices went up, service went down. I’d recommend moving your domains when you can (Porkbun have been good, though I haven’t had any incidents like this).

Best of luck!

1: https://en.m.wikipedia.org/wiki/Team_Internet

[betteryet]

Same thing with Gandi, which is a shame. Domain renewal price silently went up 3x or so last year after getting acquired.

[spondyl]

Oh damn, I didn't know this!

I've used their services for ages and even got to briefly meet the founders once in Wellington who gave a talk on Erlang.

Ah well, while it sucks that the good times may be over, I'm glad the founders got their exit :)

[thomasfromcdnjs]

aw I've always loved iwantmyname, I haven't noticed any issues other than the price increases.

Though it was the indie/personal feel they had as a registrar, I might look for alternatives.

[donohoe]

+1 for Porkbun

[raverbashing]

Pro-tip: raise your prices before you need to sell your service to cover expenses

[FunnyLookinHat]

Came here to recommend Porkbun - I've had great experience with them and so have all of the friends and family I've recommended.

[esskay]

Another vote for porkbun here. By far one of the best registrars out there right now.

[CaptainFever]

I really wish BrandShield didn't use AI as a marketing term. It just looks like it's doing a generic ctrl-F on webpages?

Then things like this happen, and people think "ooh AI is bad, the bubble must burst" when this has nothing to do with that in the first place, and the real issue was that they sent a "fraud/phishing report" rather than a "trademark infringement" report.

Then I also wish that people who knew better, that this really has nothing to do with AI (like, this is obviously not autonomously making decisions any more than a regular program is), to stop blindly parroting and blaming it as a way to get more clicks, support and rage.

[pdpi]

I find that businesses that bill themselves as ${TOOL}-users instead of ${PROBLEM}-solvers are, as a general rule, problematic. I couldn't possibly care any less whether a product is built on AI or a clever switch statement or a bazillion little gnomes doing the work by hand. I care that it solves a problem.

AI does need to die. Not so much because LLMs are bad, but rather because, like "big data" and "blockchain" and many other buzzwordy tools before it, it is a solution looking for a problem.

[johnnyanmac]

> and people think "ooh AI is bad, the bubble must burst" when this has nothing to do with that in the first place

That haphazard branding and parroting is exactly why the bubble needs to burst. Bubbles bursting take out the gritters and rarely actually kills off all the innovation in the scene (it kills a lot, though. I'm not trying to dismiss that).

[CaptainFever]

It's possible they were using LLMs (or even just traditional ML algorithms) to choose if a certain webpage was fraud/phishing instead of mere trademark infringement, though. In this case it makes sense that one would be angry that a sapient being didn't first check if the report was accurate before sending it off.

[jandrese]

When AI is being used as a cover for the bad/questionable behavior the company was already doing then there is no bubble to burst. The performance of the "AI" doesn't matter, only that it throws up a smoke shield in front of the company when people call to complain about the abuse.

[oneeyedpigeon]

I fear that ship has already sailed. I think the grifters and scammers have already abused the term enough that even decent uses of it are now tainted. I know that the two aren't strictly the same, but I would suggest using "Machine Learning" instead, which I think has more respectable connotations.

[rsynnott]

I mean, whether this has anything to do with AI or not (I’d buy that they’re using LLMs to write abuse letters or similar) it fits very nicely into the general pattern of AI breaking the internet through an endless deluge of worthless misleading spam. So, perhaps call it honorary AI?

[oneeyedpigeon]

I noticed that iwantmyname has very little presence on social media: no bluesky account and a twitter account that posts once or twice a year. That wouldn't necessarily be a problem if they responded to emergencies like this promptly, but they clearly don't so it is.

I also wonder if their "automatically disable" policy takes size/importance of site into account. Is this how they would treat all their domain owners, regardless of significance?

[clarionbell]

The significant ones have lawyer writing them letters.

[npteljes]

Brandshield is bad for overreacting, and iwantmyname is very bad for hosting such a crucial infrastructure, and having not responded to a paying customer with a good track record. I honestly don't think time of day matters, as long as the nature of the service is that it's provided and used 24/7, support staff should also be there 24/7.

[paxys]

> Because of this, I honestly think they're the malicious actor in all of this.

While I agree, the people who hired them are equally culpable. You don't get to wash your hands of the mess just because someone else is doing your dirty work.

[breakingcups]

Filing false reports like this should count as fraud.

[terminalbraid]

I'm in the outraged crowd and there should be pretty serious consequences, but it is important in the interest of justice to differentiate between fraud, negligence, and gross incompetence.

[concerndc1tizen]

I.e. as a crime rather than just a civic tort? I agree.

[kevingadd]

It does but there's no actual way to get legal recourse for false DMCA notices or anything similar. The legal system is stacked for the abusers to have their way and the victims to have no recourse, regardless of how egregious the abuse is.

[Suppafly]

>Filing false reports like this should count as fraud.

It does, but they never mess with anyone with big enough pockets to get sued for it.

[RobotToaster]

Isn't it already classed as perjury?

[Cthulhu_]

I've had the same thing happening; I run a simple forum, and some years ago people were discussing a manga, posting images of fan translated pages.

My hosting party (Hetzner) forwarded the emails and / or put it in their own system, I removed the offending images / page, replied to the email, and done, right? Wrong, the email said I had to fill in a statement through some online form somewhere; I did that too late and got more and more threatening emails like "pack your shit we're evicting you in 24 hours". Nobody seemed to actually read my replies / explanation, probably because this is so routine for them.

And I get it, nobody can be arsed to read longwinded explanations and the like for routine operations. I hope AI assisted tooling will help the overworked support employees with making decisions in favor of giving people the benefit of the doubt and the help they need; for them it's routine, but for me it was the first time I got anything like that.

[hresvelgr]

It's surprising that this happened at all. Isn't it in most business's best interests to be aware of their most high-profile customers? If this was an automatic process, it's pretty disappointing that it even occurred. If I was running a SaaS, I'd probably want to mark my important accounts so an actual human has to investigate any raised alerts instead of being dealt with by a cron.

[cipheredStones]

Something being in a business's best interests is very far from a guarantee that it'll happen.

I've worked on a team in a household-name big tech company where our mission was almost exactly "make sure we're not blowing up our most important customers for no reason". It's not nearly as easy as it sounds: defining who's important is hard, and defining what should and shouldn't be allowed is hard, and then implementing that all correctly and avoiding drift over time is tricky too.

[paxys]

Domain names themselves are a loss leader for registrars. They make money by upselling customers on hosting, email, certificates, analytics etc. So if you are just paying a couple dollars a year for a domain name and nothing else, your profile doesn't really matter. You are in the lowest tier of customers.

[Razengan]

Lemme use this opportunity for having your attention to suggest some form of collaboration or even a merger with the Godot game engine:

• itch.io users could launch the Godot Web Editor to quickly make prototypes or simple games right on itch

• Publish from the native Godot editor directly to itch.io

• Godot adopts itch.io as the official asset store for art packs etc.

• Introduce social features for devs and artists to collaborate with each other:

• A publisher could choose to add a “Fork” or similar button on their itch.io game page that downloads and opens the project source in Godot. • All "forks" published that way would include a link to the original game's page, and so on.

I think Godot+itch could/should become the Github of Games :)

[egorfine]

> I had removed the page and disabled the account

Did this account violate your ToS or the actual law? While I totally understand where are you coming from and I would probably be forced to do the same, I still tend to believe that closing a fan account is exactly the same thing that your registrar did to you.

[0x073]

It's not optimal, but he must choose between every published game there and one fanpage.

Besides that, there are so many websites with copyright content that never changes the domains, is just the domain registration bad or why they just disabled the domain?

[codatory]

Smells like tortious interference to me... and likely some form of perjury. I'd probably stop talking to them now that service is restored and get in touch with legal representation.

[rpastuszak]

Is it possible/worth to hold them financially accountable for this? (them being IWMN or BrandShield)

[andrewmcwatters]

You really need to get off both .io and this no-name registrar.

[thn-gap]

I wanted to take the time to thank you for the service you provide. itch.io is unvaluable to the indie community, and I'm perplexed when I see some devs complain about issues like this. Thabks for all your work.

[Arch485]

I smell a class action lawsuit. That's a whole lot of lost revenue and time for you and itch.io's creators.

Godspeed!

[nstart]

For what it's worth, I know Namecheap gets a meh rep, but we've been on the receiving end of several phishing/copyright reports and have responded across the spectrum in terms of time span. We've responded immediately. We've responded with an hour or so to go. In all cases, Namecheap has somehow responded quickly and resolved the issue.

[rexreed]

I coincidentally just this past week ran into a major issue with Namecheap on a fraudulent domain marketplace sale that they did not resolve properly or in a timely manner. They deserve their meh reputation. They were decent about a decade ago. Come renewal my domains up for sale are moving to Dynadot. Was considering porkbun but I sense they are heading the namecheap way.

[xinayder]

You should change registrars. Sort the situation and move to a better one.

[oneeyedpigeon]

(FYI, if you didn't already notice this, you're probably far too busy anyway, but still: https://bsky.app/profile/botherer.bsky.social/post/3lcuitcck...)

[jaromiru]

Hey, perhaps you can mediate the impact by providing an alternate way to access the site (IP, alternative domain) and posting it somewhere people will see it (bsky, here, ...)? Realistically , this may take days to resolve.

[safety1st]

So it sounds like this was DMCA abuse by Funko, aided and abetted by BrandShield, and it resulted in damages to you. Also sounds like iwantmyname just went along with it, they are probably conditioned to do so by the rules.

I would write up a complaint and send it to the incoming FTC Commissioner. Yes, I'm serious. From the signals Trump is sending if there is ever a time when Republicans may support some form of DMCA reform, it's now. He's on record talking about punishing Big Tech and supporting "Little Tech." You're Little Tech. Send copies of your letter to Funko and BrandShield. Also reach out or at least send a copy to Matt Stoller, the guy who publishes a very popular newsletter about monopoly, anti-trust and corporate abuse in America, he will be interested. Go for the throat.

[Mindwipe]

Given the OP and admin in the comments explicitly say that this wasn't a DMCA claim it would rather hurt any campaign to lie and say it was.

[tonygiorgio]

Unfortunately "serverHold" goes above registrars. I learned this the hard way. There's a variety of watchdogs that false flag things all the time, and a handful of tld's that will blindly obey these orders. I'm guessing io is one of these. You'll have to escalate it with them, though I was never successful. Good luck.

[antihero]

Can you transfer the domain out?

[leafo]

Unfortunately the domain has a hold placed on it by the registrar, so I believe transferring is disabled. I also wouldn't want to risk doing a transfer at an hour when their staff aren't available to help with the current issue.

[nonplus]

I hope you come out of this in good shape. I try to get all my (digital) TTRPGs and indie games through your platform.

[meaydinli]

Behavior from "iwantmyname" doesn't sound like they deserve your business anymore.

[derefr]

> The BrandShield software is probably instructed to eradicate all "unauthorized" use of their trademark, so they sent reports independently to our host and registrar claiming there was "fraud and phishing" going on, likely to cause escalation instead of doing the expected DMCA/cease-and-desist. Because of this, I honestly think they're the malicious actor in all of this.

I feel like there's also some missing layer of infrastructure here.

itch.io, like a lot of sites (HN being another), is meant to act as a host of user-generated content, over which the site takes a curatorial but not editorial stance. (I.e. the site has a Terms of Use; and has moderators that take things down / prevent things from being posted according to the Terms of Use; but otherwise is not favoring content according to the platform's own beliefs in the way that e.g. a newspaper would. None of the UGC posted "represents the views" of the platform, and there's no UGC that the platform would be particularly sad to see taken down.)

I feel like, for such arms-length-hosted UGC platforms, there should be a mechanism to indicate to these "brand protection" services (and phishing/fraud-detection services, etc) that takedown reports should be directed first-and-foremost at the platform itself. A mechanism to assert "this site doesn't have a vested interest in the content it hosts, and so is perfectly willing to comply with takedown requests pointed at specific content; so please don't try to take down the site itself."

There are UGC-hosting websites that brand-protection services already treat this way (e.g. YouTube, Facebook, etc) — but that's just institutional "human common sense" knowledge held about a few specific sites. I feel like this could be generalized, with a rule these takedown systems can follow, where if there's some indication (in a /.well-known/ entry, for example) that the site is a UGC-host and accepts its own platform-level abuse/takedown reports, then that should be attempted first, before trying to get the site itself taken down.

(Of course, such a rule necessarily cannot be a full short-circuit for the regular host-level takedown logic such systems follow; otherwise pirates, fraudsters, etc would just pretend their one-off phishing domains are UGC platforms. But you could have e.g. a default heuristic that if the takedown system discovers a platform-automated-takedown-request channel, then it'll try that channel and give it an hour to take effect before moving onto the host-level strategy; and if it can be detected from e.g. certificate transparency logs that the current ownership of the host is sufficiently long-lived, then additional leeway could be given, upgrading to a 24-72hr wait before host-takedown triggers.)

[robertduncan]

There is a parallel to the public suffix list, which domains like github.io are listed on: https://publicsuffix.org/list/public_suffix_list.dat

[nguyenquocthao]

So Linode hosts your server, and iwantmyname provides your domain? If they want they can take down your server and your domain? Is there any server provider / domain provider who doesn't hold that kind of power?

[JosefAlbers]

It's working again now.

[seanthemon]

man, this shit is ridiculous.. now we can't even make fan pages?

Will you be moving away from this registrar? It seems like it could very easily be abused again.

[jeroenhd]

Some companies have always been terrible about this. Fan projects involving companies like Nintendo or Take Two Interactive (GTA) are like lawyer bait. Disney has hired lawyers to sue a daycare center that had (clearly unofficial) character art painted on the walls. It's dystopic, but it's the world we live in.

I didn't really expect Funko or 10:10 Games to be like that, but then again I didn't expect anyone would like Funko enough to make a fan page about their dolls.

Other companies allow fans to do pretty much whatever you want with their IP as long as you don't turn it into (too much of) a business. Sega has even hired a fan for their remasters rather than DMCA his project into oblivion.

When companies do this, I interpret this as the company giving a clear message: "don't be a fan of our work or we may apply legal pressure".

[oneeyedpigeon]

After this, everyone will be moving away from this registrar...

[Hamuko]

Fan anything has always been at the mercy of the trademark owner.

[Suppafly]

I wish brandshield would pull this shit with someone that was large enough to sue them for fraud or tortious interference.

[mort96]

That's extremely disappointing from iwantmyname. While I haven't used it, it was always on my mind as a potential registrar when buying a domain. I think I'll have to reconsider.

[lxgr]

> it's no one's fault and no one's to blame

There's obviously somebody to blame. Somebody getting a legitimate domain taken down for hours should have consequences, if only to make mistakes more expensive for trigger-happy automated "IP protection" services (the only signal they'll probably understand).

The question is just if itch.io has the funding and energy to actually pursue the matter legally, now that it's technically resolved. I couldn't blame them for just changing registrars instead.