Competitor Portal

Recent findings

The 20 most recent test results and intel updates. Filter below — or open the full feed for paginated history.

All 80 findings

Competitor

Operator

Threat

Remote accessFanDuel2d agoGeoComply / FanDuel NJ: Mac-to-Mac Tailscale remote screen sharing blocked immediately — Blocked Software rule ✓GeoComply's desktop solution (PLC) blocked the same Mac-to-Mac remote screen-sharing technique that went undetected on BetRivers PA / XPoint last week. Remote Mac screen sharing via Tailscale on FanDuel NJ triggered the Blocked Software rule immediately — no bets were possible. A direct, same-method, same-week comparison against the competitor gap.
XpointRemote accessRushStreet Interactive (BetRivers)2d agoXPoint / BetRivers PA: CIV-88 retest — FaceTime RDP sustained for 1 hour; Tailscale Mac-to-Mac RDP undetectedFollow-up to last week's CIV-88 advanced spoofing review on BetRivers Pennsylvania (XPoint): FaceTime screen sharing sustained a full hour of remote wagering from New Jersey onto an in-state iPhone in PA — sportsbook and casino bets placed continuously with no block. Tailscale Mac-to-Mac RDP via Finder screen sharing also failed detection — unattended full control of the in-state host, geolocation check passes against the host's PA position.
RadarRemote accessVPNFake GPS appWind Creek Bethlehem1w agoRadar / Wind Creek Casino Online PA: iOS RDP, DroidVNC + Tailscale, and Android VPN undetected (results June 19)Full integration validation of Wind Creek Casino Online PA (Radar), results delivered June 19: iOS FaceTime and iPhone Mirroring undetected (TN operator controlling in-state iPhone after local login), Android DroidVNC + Tailscale undetected, Android Turbo VPN undetected. iOS VPN blocked at login and mid-session. TeamViewer, AnyDesk, HopToDesk, Android FLA, and ~90 m cross-border buffer compliant. Rooted Android mock location caught; root itself undetected.
XpointRemote accessJailbreak / RootFake GPS appRushStreet Interactive (BetRivers)1w agoXPoint / BetRivers PA: Tailscale macOS RDP (unattended), Magisk mock-flag suppression, and FaceTime handoff undetectedAdvanced spoofing review of BetRivers Pennsylvania (XPoint): two Macs on the same Tailscale account — Mac1 (out of state) gets full unattended control of Mac2 (in PA) via Finder screen sharing. Rooted Android with Magisk + a low-level module suppresses the mock-location flag before BetRivers reads it. FaceTime RDP requires local login + 2FA, then full remote control with no further local presence.
XpointRemote accessJailbreak / RootFake GPS appRushStreet Interactive (BetRivers)2w agoXPoint / BetRivers PA: iOS RDP, Tailscale macOS RDP, and rooted Android mock location undetected; standard RDP + FLA blockedCompliance analysis of BetRivers Pennsylvania (XPoint) surfaced three undetected attack paths: native iOS remote control via FaceTime and iPhone Mirroring (bets placed from an out-of-state operator on an in-state device), Tailscale combined with macOS native screen sharing, and rooted Android with concealed mock-location telemetry. TeamViewer, AnyDesk, HopToDesk, IP-change checks, Android fake-location apps, and a resigned iOS app were all compliant.
Remote accessBally Bet1mo agoGeoComply / Bally Bet NJ: remote screen control via Tailscale blocked at login and mid-session ✓GeoComply's geolocation product blocked a remote-screen-control attack on Bally Bet NJ — macOS Native Screen Sharing driven over a Tailscale tunnel, with one Mac handing full screen control to a second Mac in a different location. Detection fired both at login and mid-session with a Blocked_software error. A direct compliance advantage over the three competitor integrations that missed the same attack this week.
RadarRemote accessUnderdog Fantasy1mo agoRadar / Underdog DFS: remote screen control via Tailscale undetected for 20+ minutesA remote operator took full control of a device inside the permitted state over a Tailscale-tunnelled screen-sharing session and placed bets on Underdog DFS. Radar did not detect or block the remote-control session, which stayed active for more than 20 minutes. Part of the expanded remote-control campaign that began with the Bet365 NJ (XPoint) finding.
RadarNear borderBoundary crossingRemote accessbet3651mo agoBet365 MI (Radar / XPoint): full competitive validation — near-border lag, FaceTime + Windows RDP undetected, UX recovery brokenFull Bet365 MI integration validation surfaced five distinct issues in a single test cycle: unreliable behaviour at 200–1,000 m from the Canadian border, an incorrect 'NJ-residents-only' jurisdiction prompt when crossing Detroit↔Canada, iOS FaceTime RDP undetected (MA → MI), Windows RDP undetected (MA → MI), and persistent app glitches after VPN detection that force a full restart. Multiple compliance and UX gaps across mobile + web layers.
RadarSideload (PlayCover)FanDuel1mo agoRadar / FanDuel WV: iOS betting app runs undetected on Mac via PlayCover (real-money bet placed)Using PlayCover to run the FanDuel iOS app directly on a Mac, the tester logged in and completed a real-money bet on FanDuel West Virginia. Radar did not detect that the app was running in a non-standard environment. Both the standard and an advanced variant of the technique produced the same result. Confirms FanDuel WV as the standing outlier on a vector that other Radar-protected operators block.
XpointRemote accessbet3651mo agoXPoint / Bet365 NJ: macOS↔macOS RDP via Tailscale + Screen Sharing undetectedUsing Tailscale to put two Macs on the same private network and macOS's built-in Screen Sharing to drive one from the other, the tester accessed Bet365 NJ from a different physical location and placed wagers. XPoint did not detect the remote session. Follow-up testing across Radar, OpenBet, and GeoComply-integrated clients has been requested.
OpenBetNear borderBoundary crossingFanatics Sportsbook1mo agoOpenBet / Fanatics TN: WV casino-game session maintained 10m inside Virginia border (iOS)Close-to-border testing on iOS: an active West Virginia casino game session on Fanatics was maintained consistently while standing 10 meters inside the Virginia border. Not reproduced on Android. Meaningful compliance risk in areas where homes or businesses sit directly on the state line.
RadarGPS spooferFake GPS appbet3651mo agoRadar / Bet365 MI: GPS simulator accessory bypass, restriction not re-applied on re-entryA hardware GPS simulator accessory was used to spoof the tester's physical location into Michigan from Tennessee. After an initial login error, a second login attempt succeeded with no further location checks enforced. Real-money bets placed on the MI casino. The restriction that appeared on first login was not re-applied on re-entry — repeatable compliance gap.
RadarRemote accessbet3651mo agoRadar / Bet365 NJ: Tailscale + RealVNC RDP undetected for 25+ minutes of continuous bettingA Mac remotely controlled an Android device on a separate network via Tailscale + RealVNC. The tester placed bets continuously for over 25 minutes on Bet365 NJ (Radar) with no interruptions, timeouts, or restrictions triggered. Radar's geolocation checks did not detect the remote session at any point.
RadarRemote accessNear borderBoundary crossingDraftKings1mo agoRadar / DraftKings DFS NJ: full integration validation — RDP inconsistent, cross-border lag, generic UXFull integration validation of the post-migration DraftKings DFS NJ deployment on Radar. RDP detection is inconsistent (Zoom + AnyDesk undetected; TeamViewer blocked May 8 but undetected on May 13–14). Cross-border session lag of ~100–150m past the PA→NJ line vs GeoComply's 2–5m. Generic Account-Locked error messaging with no user guidance.
RadarResigned / tampered appBetSaracen1mo agoRadar / Bet Saracen AR: modified ("resigned") iOS app placed bets from MichiganA modified version of the Bet Saracen iOS app — altered to remove Apple's integrity protections — was used to place bets remotely from Michigan with no issues. The same account on the unmodified app was correctly blocked. Direct fraud and compliance risk: bad actors can use modified apps to bet from any location.
XpointRemote accessRushStreet Interactive (BetRivers)1mo agoXPoint / RSI BetRivers NJ: Tailscale RDP fails detection in most cases, bypass-by-logoutXPoint fails to detect Tailscale-based remote access in most cases against RSI BetRivers NJ, allowing bets from a physically separate location. When detection did trigger it was inconsistent and easily bypassed by logging out and back in. Two attack methods confirmed — one requiring brief one-time approval, one fully unattended.
XpointGPS spooferFake GPS appRushStreet Interactive (BetRivers)1mo agoXPoint / RSI BetRivers TN: GPS simulator fully undetected, MI casino bets from TennesseeHardware GPS simulator accessory went fully undetected on RSI BetRivers Tennessee (XPoint). Tester logged into the Michigan app from Tennessee and played a casino game with no errors or restrictions triggered.
RadarDisplacementComplianceDraftKings2mo agoDraftKings DFS NJ migrated from GeoComply to Radar (web only)Confirmed provider transition: DraftKings has moved its New Jersey DFS web product from GeoComply to Radar. Sportsbook and mobile apps stay on GeoComply. Dual-vendor compliance testing underway.
RadarResigned / tampered appDevice farmSideload (PlayCover)FanDuel2mo agoRadar / FanDuel WV: three exploitation methods bypass restrictions from TennesseeConfirmed compliance vulnerabilities at FanDuel WV: users can bypass geographical restrictions from Tennessee via iOS app resigning, virtualised environment emulation via VMOS, and sideloading via PlayCover on ARM-based macOS. Each technique successfully facilitated out-of-state betting.
OpenBetRemote accessComplianceFanatics Sportsbook2mo agoOpenBet / Fanatics TN: HopToDesk + iPhone screen mirroring bypassed detectionFanatics TN flagship deployment: HopToDesk + iPhone screen mirroring both bypassed OpenBet Locator's RDP protocols. Out-of-Tennessee wagering succeeded on both iOS and Android.

See all 80 findings on the Updates feed

Competitor	VPN	Proxy	Remote access	Fake GPS app	GPS spoofer	Emulator	Device farm	Jailbreak / Root	Resigned / tampered app	Sideload (PlayCover)	Browser extension	MITM / replay	Tor	Misses
Radar														10/13 miss
OpenBet														5/13 miss
Xpoint														7/13 miss
Locance														5/13 miss
GeoLocs														7/13 miss

Competitor Portal

Detection matrix

Strongest findings

XPoint / BetRivers PA: CIV-88 retest — FaceTime RDP sustained for 1 hour; Tailscale Mac-to-Mac RDP undetected

GeoComply / FanDuel NJ: Mac-to-Mac Tailscale remote screen sharing blocked immediately — Blocked Software rule ✓

XPoint / BetRivers PA: Tailscale macOS RDP (unattended), Magisk mock-flag suppression, and FaceTime handoff undetected

Radar / Wind Creek Casino Online PA: iOS RDP, DroidVNC + Tailscale, and Android VPN undetected (results June 19)

XPoint / BetRivers PA: iOS RDP, Tailscale macOS RDP, and rooted Android mock location undetected; standard RDP + FLA blocked

Radar / Underdog DFS: remote screen control via Tailscale undetected for 20+ minutes

GeoComply / Bally Bet NJ: remote screen control via Tailscale blocked at login and mid-session ✓

XPoint / Bet365 NJ: macOS↔macOS RDP via Tailscale + Screen Sharing undetected

Social & monitoring signals

Recent findings

Pinned

Reference docs