Hi Patrick,
I looked into this and found that there is no direct way for munchkin to figure out the top level domain accurately for 2 letter country domains, in your case "risk.io".
Some ccTLD's such as ".uk" only allow 3rd level subdomains such as "*.co.uk" and "*.org.uk" while some others allow 2nd as well as 3rd level. Munchkin behaves conservatively in these cases and only sets it's cookie at the 3rd level by default.
You can override this behavior by a small change in your munchkin embed code. In your Munchkin embed code make the following change
Munchkin.init("XXX-XXX-XXX");
change the above to
Munchkin.init("XXX-XXX-XXX",{ domainLevel : 2 });
This will make munchkin recognize your 2nd level domain under the ".io" ccTLD