Using the cough undocumented cough stat(102) from a game hosted on itch.io, I got back:

v6p9d9t4.ssl.hwcdn.net

This is indeed the url of the iframe (which doesn't help).
A more correct behavior would be to report the parent page url, with the benefits of:

• having a predictable outcome
• actually preventing rogue hosting (somehow...)

Note: Looking at the HTML, I see that url is retrieved from:

var str = window.location.hostname;

Using that alternate code would fix the bug:

var str = (parent !== window) ? document.referrer : document.location;

I ran into this problem with another game I was making and just decided to not update the itch.io ver cause of it. If I could retrieve a reliable url that would be great