Verdict
itch.io appears legitimate.
Our checks found nothing pointing to fraud. Ordinary care still applies when you pay or sign in.
| What this site appears to be | Public-facing storefront and community hub for indie games offering discovery, sales, bundles, developer tools, and a desktop app. Contains login/register and upload features but no obvious high-risk financial solicitations. |
|---|
Evidence status and limitations
Evidence completeness: UNKNOWN
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 1 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0 reportsAbuseIPDB; shared hosting inflates this count | Noted |
| Domain age | 15 years oldRegistered history | Clear |
| Web archive | Archived since 20233 snapshots | Clear |
| Certificate | Encrypted connectionIssued by WE1 | Noted |
The page as captured
No screenshot is retained for this report.
Key findings
- Automated classification: Not Scam.
- Domain age: more than 10 years (registration continuity).
- Public web-archive history exists since 2023.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Overview
This website is a public-facing marketplace and community hub for independent games and digital assets, offering game discovery, direct sales, bundles, creator uploads, developer tools, community features, and a desktop application for managing downloaded games.
Scam/Impersonation Risk
No scam, phishing, impersonation, or identity contradictions were observed. The homepage presents a coherent indie-game marketplace rather than a high-risk financial solicitation, and the login, registration, and upload functions did not expose sensitive forms, hidden forms, external password destinations, wallet connections, or credential-harvesting behavior. One isolated external detection marked the domain as malicious, but it was unconfirmed and was not corroborated by the broader reputation, page, or behavioral evidence; it is therefore treated as a soft reputational signal rather than a confirmed threat. An automated brand-similarity signal was likewise not supported by the site's actual content, which consistently identifies the service as an indie-game platform.
- The homepage contains substantial storefront content, including game discovery, sales, bundles, developer uploads, community features, and desktop-app distribution.
- The site's transport and registration records show a domain created on 2011-10-27T23:55:37Z, with an age of 14.8 years.
- Web-archive records contain 3 snapshots spanning 2023-12-30T01:43:48Z to 2025-08-25T00:06:56Z across 3 tracked years; this represents limited captured coverage, not a recent domain age.
- The homepage analysis recorded 3 forms, with no sensitive form, hidden form, untrusted destination, or wallet-related activity.
Regulatory Verification Notes
Available evidence is consistent with an established, apparently legitimate digital-commerce platform, supported by a long-established registration, a strong global traffic footprint, high page authority, stable page behavior, mainstream infrastructure, and consistent business-model content. The apparent operator identity is not independently verified, so the site's own branding should not be treated as conclusive proof of the real-world legal entity. No regulated financial-service claim or license claim was identified; for this non-financial marketplace, that is a disclosure and business-identity verification point rather than evidence of a scam. The registrar is 1API GmbH, and the site has an established presence across several public social platforms.
- The domain is registered through 1API GmbH and has an expiration date of 2030-10-27T22:55:37Z.
- Hosting is provided through AS13335, CLOUDFLARENET - Cloudflare, Inc., US.
- The site's TLS certificate uses issuer WE1, validation level DV, and is valid to 2026-09-20T13:15:02+00:00.
- The homepage links to the site's About and FAQ pages and presents a structured marketplace model involving direct sales, bundles, creator uploads, and optional platform fees.
What to Verify Next
Before credential or payment interactions, an independent check should confirm the legal merchant identity associated with any purchase, the applicable return or refund terms, and the payment-protection mechanism. For creator or developer activity, contractual terms governing platform fees, content submission, payouts, and account access should be reviewed. Official support and contact channels should be confirmed through independently established platform profiles rather than relying solely on a page-level contact route.
- The homepage provides direct paths to About, FAQ, login, registration, upload, and community functions for independent review.
- Public social links are present for YouTube, Twitter, Mastodon, and Facebook, providing channels through which official platform presence can be cross-checked.
- The marketplace advertises both free and paid content, including bundles and creator-uploaded material, making transaction and seller-policy review relevant.
- The desktop application is offered as a download, making publisher authenticity and software-download provenance relevant to any installation decision.
Summary Verdict
The overall posture is high trust and low risk, with the available evidence consistent with an established, apparently legitimate website and no observed scam or impersonation contradiction. The principal residual uncertainty concerns independent confirmation of the real-world operator identity, not evidence of malicious website behavior.
Infrastructure Integrity
The site is protected by Cloudflare CDN and WAF services, with observed edge infrastructure and potential origin candidates. This architecture is a mitigating control that reduces direct exposure of the service infrastructure, but it is not, by itself, proof of legitimacy.
Closing Assessment
Ordinary use is proportionate to the assessment, while independent merchant-identity, terms, and payment-protection checks should be completed before credentials or payments are submitted.
Written analysis generated 2026-08-13 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
No rule findings contributed to this verdict.
Identity verification
| Status | LIKELY |
|---|---|
| Identity score | 79/100 |
| Identity verification confidence | 78% |
- Trusted social count=3
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of itch.io.
- The request stayed on itch.io. It was not redirected to another domain. Clear
- Registration is published under 1API GmbH. Clear
- DNS for this domain is served by cloudflare.com, across 2 name servers. Noted
- The registration is paid up to 2030-10-27. Clear
- The earliest public archive of this site is from 2023-12-30. Clear
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | 1API GmbH |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2a06:98c1:3123:8000:: |
| Name servers | noah.ns.cloudflare.com, dawn.ns.cloudflare.com |
| SSL issuer | WE1 |
| SSL expiry | 2026-09-20 |
| Domain age | 14.80 years (continuous registration) |
| Domain expiry | 2030-10-27 |
| Archive first seen | 2023-12-30 |
| Archive snapshots | 3 |
| Reputation | VirusTotal: 1 flagged | AbuseIPDB: 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about itch.io at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.