I actually made this thread to point out that the "classical" try-my-game-on-discord-scam is not the only method used and give some general tipps. It is not necessary for the scammers to socially target people and distribute password protected links on Itch. They can just spam their projects in the open. I saw several times the original and a fake shown up in a search side by side. It is just sick. Only last week I saw a fake game aimed at children.
And itch is indexed on regular search engines quite fast. So de-indexing does not even help much. People can find the scam site by accident by googling some indie games.
This might also be the reason why there are so many fake blog posts on Itch. The scammers not only post projects, they post devlogs with links to malware in the guise of some game announcement. I saw such a fake account with over 40 followers. How ... what ... I cannot understand this.