Skip to main content

GeoLocs

Active competitor

mkodo's iGaming geo product. Crown-Corp moat in Canada + Alberta live ahead of regulated market opening. 25+ operators.

geolocs.iomaxim.mosinVerified 2mo ago
Compare
CanadaUKEUUSLATAMLotteryiGamingSportsbook#mkodo#ontario-incumbent#canadian-crown-corp#no-desktop-plugin#alberta-launch-urgent

Detection scorecard

How GeoLocs handles every spoofing technique we test for. Click any cell for findings.

Full matrix →
  • Detected
  • Partial
  • Missed
  • Not tested
CompetitorVPNProxyRemote accessFake GPS appGPS spooferEmulatorDevice farmJailbreak / RootResigned / tampered appSideload (PlayCover)Browser extensionMITM / replayTor
GeoLocs

Strongest findings

Failed and partial test outcomes ranked for sales impact — what to lean on in a call.

All findings

Test results and intel tagged to GeoLocs.

Operator
Threat

Battle card

Talking points for a live sales call.

GeoLocs (by mkodo, London UK; founded ~2000, GeoLocs platform live since 2011, publicly launched 2023) is a UK-based iGaming-exclusive geolocation platform. Its primary strength is deep Canadian Crown-Corporation relationships (OLG, BCLC, AGLC, WCLC, ALC — 10+ year embedded) and Ontario commercial market incumbency (14+ operators since 2021). 10 billion+ lookups/year claimed (Sep 2025 brochure). The mobile + web SDK is real and broadly deployed, but there is no desktop plugin equivalent — GeoVerify (BLE app pairing) was announced but is unproven and has no US-state regulatory approval.

Watch out for

  • Crown-Corp moat: OLG, BCLC, AGLC, WCLC, ALC are structurally locked in via 10+ year app-building relationships.
  • Ontario commercial incumbency: 14+ operator relationships, first mover in 2021.
  • Alberta presence (AGLC + WCLC) ahead of regulated market opening — GeoComply has no Alberta footprint.
  • Sub-5-day integration claim with self-service portal + code-free re-check threshold configuration.
  • Distance-to-Boundary (DTB) returned in every response — operator-configurable re-checks.
  • GLI-certified (Sep 2024), AGCO, GPEB (BC), ISO 27001:2022 — credible compliance credentials.
  • Active US lottery expansion: Arizona Lottery + Kansas Lottery (Sep 2025 brochure).
  • No exclusivity in contracts — operators can dual-source freely.

How we win

  • AnyDesk & Assistant RDP — NOT DETECTED [CRITICAL]: Windows-PC-driven Android session played multiple casino games at Casumo (Ontario) and Superbet (Brazil).
  • FLA — NOT DETECTED [CRITICAL]: iAnyGo FLA from Indiana (with and without VPN) played highflyercasino.com Ontario; Android-only FLA also succeeded.
  • iOS emulator — NOT DETECTED [CRITICAL]: XCode-emulated iPhone on MacBook played real-money games on highflyercasino.com.
  • IP change — NOT DETECTED for 30+ minutes (Casumo iOS, Apr 2025). No IP-change monitoring service confirmed.
  • Session persistence — 15–60+ minutes after location services disabled mid-game; structural consequence of the web-only, no-background-process model.
  • Cross-border — session not terminated for 20+ minutes after a user drove 2,000m+ from Ontario into Quebec (Sep 2024).
  • VPN mid-session (legal → non-legal) — Casumo desktop tester switched Ontario → Portugal mid-slot and continued playing.
  • No desktop plugin — cannot operate in PLC-required US iGaming states.
  • GPS + IP only signal set; no cellular, BLE, barometer, NTP, or device fingerprint confirmed.
  • SDK is gated — no API/encryption/auth analysis possible yet.

Capability claims

What they say they do, grouped by category. Cross-check against the detection scorecard above — claims and tests don't always match.

Geolocation

How accurately and reliably the product determines a user's real location.

  • GPS / OS locationUses native device GPS or OS-level location services.
    ● Yesverified

    iOS, Android, Mobile Web, Desktop Browser. No React Native / Flutter wrappers confirmed.

  • Wi-Fi triangulation
    ◐ Partialinferredstale

    Not explicitly confirmed; OS-level only.

  • IP geolocation
    ● Yesverifiedstale

    IP used as supplementary validation per FAQ.

  • IP-change detectionContinuously monitors IP and re-runs geolocation on Wi-Fi ↔ cellular or VPN swap (GeoComply MyIP equivalent).
    ○ Noverified

    NOT detected for 30+ minutes (Casumo iOS, Apr 2025). No IP-change monitoring service confirmed.

  • Boundary / state-lineHandles users moving across regulated boundaries during an active session.
    ○ Noverified

    Cross-border (Ontario → Quebec, 2,000m+) not terminated for 20+ minutes.

  • Near-border accuracyMulti-point aggregation + buffer-zone handling near regulated borders; measured as pass rate at 250m.
    · Unknownrumor

    No published pass rate at 250m. Testing priority.

  • Pre-login pre-check
    ◐ Partialinferredstale

    DTB (Distance to Boundary) returned every response.

  • Multi-jurisdictionSingle integration handling operators in multiple regulated states (GeoComply Multipass / Dynamic Boundaries equivalent).
    ◐ Partialinferredstale

    Self-service portal with code-free re-check thresholds; multi-state DFS-class support unclear.

  • Desktop plugin (PLC-class)Native desktop client / plugin required by PA, NJ, MS and most US iGaming regulators.
    ○ Noverified

    No desktop plugin equivalent. GeoVerify (BLE pairing) announced but unproven, no US state approval.

  • On-property BLE geofenceBluetooth Low Energy precision geofencing for tribal / on-property venues (PinPoint-class).
    ◐ Partialrumorstale

    GeoVerify BLE pairing announced; not confirmed live, no regulatory approval.

Anti-spoofing detection

Detection coverage for the spoof vectors tested by the Competitive Intelligence team. Cell values reflect SDK-level detection of the listed vector at the most recently tested operator.

  • VPN exit nodesDetects commercial VPN exit nodes (NordVPN, ExpressVPN, Surfshark, etc.).
    ◐ Partialverified

    GLI-confirmed VPN detection; mid-session VPN swap (Ontario → Portugal) NOT detected on Casumo desktop.

  • Proxy / residentialDetects datacenter and residential proxies — the harder class of IP obfuscation.
    ◐ Partialverifiedstale

    Claims residential proxy detection (GLI confirmed).

  • Tor exits
    · Unknownrumorstale
  • Remote desktop (RDP)Detects AnyDesk, TeamViewer, FaceTime, Assistant, HopToDesk, iPhone screen mirroring, RustDesk and similar remote-control sessions.
    ○ Noverified

    AnyDesk + Assistant RDP NOT detected on Casumo (Ontario) and Superbet (Brazil).

  • Fake-location appsDetects iAnyGo / Fake GPS / mock-location apps on iOS and Android.
    ○ Noverified

    iAnyGo (with/without VPN) and Android-only FLA both succeeded on highflyercasino.com Ontario from Indiana.

  • Hardware GPS spooferDetects HackRF / BladeRF and GPS-simulator-device signal injection.
    ◐ Partialverifiedstale

    GPS spoof detection claimed (GLI confirmed).

  • Emulator / VMDetects Xcode iOS Simulator, BlueStacks, Genymotion and similar virtual environments.
    ○ Noverified

    XCode iOS emulator on MacBook played real-money games on highflyercasino.com.

  • Device farm / VMOSDetects VMOS / virtualized Android device-farm environments used for multi-accounting.
    · Unknownrumorstale

    Not yet tested — Alberta-launch retest priority.

  • Jailbreak / rootDetects jailbroken iOS, rooted Android (incl. Magisk hidden root), and Frida / runtime-hook tampering.
    · Unknownrumorstale

    Not confirmed in testing.

  • Resigned / tampered appDetects iOS apps that have been re-signed / Android apps that have been repackaged with injected code.
    · Unknownrumorstale

    Not yet tested — Alberta-launch retest priority.

  • Sideload (PlayCover)Detects ARM-macOS iOS sideloading via PlayCover and equivalent hardware-abstraction loaders.
    · Unknownrumorstale
  • Browser extension spoofDetects Chrome / browser extensions that spoof location (Location Guard, Hola, etc.).
    · Unknownrumorstale
  • Session terminationTerminates session when location services are disabled mid-game or device leaves the jurisdiction.
    ○ Noverified

    Sessions persist 15–60+ minutes after location services disabled (Casumo + High Flyer, multiple tests Aug–Sep 2024). Re-confirmed in Apr 28 monthly brief.

  • MITM / replay attackResists network-level interception, request tampering, and replay attacks against the SDK ↔ backend channel.
    · Unknownrumorstale

Identity & KYC

Document verification, biometric liveness, sanctions screening.

  • Document scan / OCR
    ◐ Partialverifiedstale

    Via Shufti Pro partner, not native.

  • Biometric liveness
    ◐ Partialinferredstale

    Shufti Pro partner.

  • Sanctions / PEP
    ◐ Partialinferredstale

    Shufti Pro partner.

  • AML / responsible gaming
    ○ Noverifiedstale
  • Reusable identity
    · Unknowninferredstale

Platform coverage

Which surfaces the SDK / product runs on.

  • iOS native
    ● Yesverifiedstale

    Confirmed native iOS app (Casumo).

  • Android native
    ● Yesverifiedstale
  • Web / browser
    ● Yesverifiedstale

    Mobile + desktop browser.

  • React Native
    · Unknownrumorstale

    Not confirmed.

  • Flutter
    · Unknownrumorstale
  • Unity
    · Unknowninferredstale
  • .NET / desktop
    ○ Noverifiedstale

    No native desktop app or plugin.

  • Server-side API
    ● Yesverifiedstale

    mCloud Gateway API management.

Compliance & certification

Regulatory coverage and certifications.

  • US state-licensed (iGaming/sportsbook)
    ◐ Partialverified

    Arizona Lottery + Kansas Lottery (Sep 2025 brochure). No PLC-equivalent product approved in any US iGaming state.

  • US tribal / on-property
    ○ Noinferredstale
  • Canadian provincial
    ● Yesverifiedstale

    Crown Corp moat: OLG, BCLC, AGLC, WCLC, ALC. Ontario commercial: 14+ operators.

  • European (MGA/UKGC)
    ● Yesverifiedstale

    UK Rank Group is the origin client (2011). Rootz, Casino Days, Rhino Entertainment in Malta/multi-jurisdiction.

  • LatAm (Brazil SPA)
    ● Yesverifiedstale

    Superbet (Brazil) confirmed Jan 2025 via SCCG partnership.

  • SOC 2 Type II
    ● Yesverifiedstale

    ISO 27001:2022 confirmed.

  • ISO 27001
    ● Yesverifiedstale

    Sep 2024.

  • GLI-certified
    ● Yesverifiedstale

    GLI certification Sep 2024.

Fraud & device intelligence

Device fingerprinting, IP intelligence, behavioral signals, account-takeover detection.

  • Device fingerprint
    ○ Noverifiedstale

    No fingerprint signal confirmed in testing.

  • IP intelligence DBMaintained DB of VPN / TOR / proxy / hijacked-residential IPs with documented refresh cadence (GeoGuard equivalent).
    ◐ Partialinferredstale

    GLI-confirmed IP verification; no published DB size or refresh cadence.

  • Behavioral signals
    ○ Noverifiedstale
  • Velocity / impossible travel
    ◐ Partialinferredstale
  • Bot detection
    · Unknowninferredstale
  • Account takeover
    ○ Noinferredstale
  • Chargeback mgmt
    ○ Noverifiedstale

Ops & integration

How easy the product is to integrate, observe, and operate.

  • Self-serve onboarding
    ● Yesverifiedstale

    Self-service portal: geo-boundaries, data export, activity map, UAT testing.

  • Case management UI
    ◐ Partialinferredstale
  • Webhook delivery
    ● Yesinferredstale
  • Real-time API
    ◐ Partialverifiedstale

    Brazil testing: slowest of 3 providers (Radar > GeoComply > GeoLocs).

  • Analytics dashboard
    ● Yesverifiedstale

    Self-service portal includes activity map + UAT testing.

  • Audit log export
    ◐ Partialinferredstale
  • Encrypted responseDetection flag names hidden from the end user (GeoComply uses encrypted XML; most challengers expose JSON flag names).
    · Unknownrumorstale

    SDK gated — encryption model unknown.

  • SDK hardeningSDK is signed, obfuscated, and license-bound — not findable / patchable to inject coordinates client-side.
    · Unknownrumorstale

    SDK is gated — no API / encryption / auth analysis possible yet.

Commercial

Pricing model and go-to-market shape.

  • Usage-based pricing
    ● Yesinferredstale

    Commercial terms flexible; no exclusivity in contracts.

  • Flat license / enterprise
    ◐ Partialinferredstale
  • Free tier / trial
    · Unknowninferredstale
  • Publicly listed pricing
    ○ Noverifiedstale
  • Bundled with platformGeo is bundled inside a broader platform deal (OpenBet, GeoLocs/Mkodo, Playtech).
    ● Yesverifiedstale

    Bundled with mkodo's iGaming app development service (350+ App Store submissions).

Resources

Briefings, source docs, and external links.

Case study (1)

Drive doc (1)

Website (2)

Drive folder (1)

Six confirmed compliance failures

RDP, FLA, iOS emulator, IP-change, cross-border, and session persistence all failed across Casumo, High Flyer, Superbet, Betty, and Casino Time in Betting Hero testing (Jul 2024 – Apr 2025). These are the headline talking points for any Ontario or Alberta operator conversation.

Confirmed gaming clients (April 2026)​

Canada — Crown Corporations / Lotteries (10+ year structural lock-in)​

OperatorMarketNotes
OLG (Ontario Lottery & Gaming)OntarioLaunch partner 2021. Via Bede Gaming (renewed Apr 2026).
BCLC (PlayNow)British ColumbiaLive since 2012. Oldest GeoLocs client.
AGLC (PlayAlberta)Albertamkodo built the PlayAlberta App. Live ahead of regulated commercial market opening.
WCLC (Western Canada Lottery)Western CanadaGeolocation for the WCLC western provinces footprint.
ALC (Atlantic Lottery)Atlantic CanadaPart of mkodo's Canadian lottery portfolio.

Canada — Ontario commercial​

OperatorNotes
Betty CasinoLive Apr 2024, renewed Jul 2025. $184M net revenue run rate. VPN messaging gaps in testing.
Maverick GamesLive Jul 2025. First Ontario sportsbook since Fitzdares departed.
Casino TimeCharitable gaming. Session persistence gap (Jul 2024).
The Mill AdventurePlatform provider. Live Jun 2024.
High Flyer Casino (Ellipse)Primary Betting Hero test site. FLA, emulator, session persistence all failed.
Jumpman Gaming / The Six GamingOntario entry Oct 2023.
White Hat GamingPlatform / aggregator. CGA announcement.
Casumo Casino (Pret Play)Only confirmed native iOS app. RDP not detected, IP-change gap.

USA — State lotteries​

OperatorMarketNotes
Arizona LotteryArizonaNamed on Sep 2025 brochure.
Kansas LotteryKansasNamed on Sep 2025 brochure. New US state lottery — previously unknown.

Brazil​

OperatorNotes
SuperbetCONFIRMED Jan 2025 (Betting Hero). FLA detected ✓. AnyDesk RDP not detected ✗.
Additional operators via SCCGSCCG partnership (Apr 2024).

UK / Europe​

OperatorMarketNotes
Rank GroupUKOrigin client (2011). GeoLocs built for App Store compliance.
RootzMalta / multi-jurisdictionOperates NightRush, Wildblaster, CasinoFriday.
Casino DaysMulti-jurisdictionMalta-licensed. Part of Rhino Entertainment.
Rhino EntertainmentMulti-jurisdictionPlatform / operator group.

Strategic risks​

  1. Canadian Crown-Corp moat [CRITICAL]. Structurally cannot be displaced through a standard competitive sales process. Don't compete for Crown-Corp lottery accounts unless invited in.
  2. Ontario commercial incumbency [CRITICAL]. Push the RDP / FLA / emulator / session-persistence findings into account-management + renewal discussions as primary competitive data.
  3. Alberta first-mover [CRITICAL — action now]. Already live with AGLC + WCLC before the regulated commercial market opens. GeoComply has no Alberta presence. The May 5 and May 11 weekly syncs both put "Ontario Competitor Analysis — Mkodo + LocationSmart retest in anticipation of Alberta launch" as the top Field Testing priority. Betting Hero's May 5 scope adds "mkodo Geolocs — Full Validation."
  4. Sub-5-day integration narrative [HIGH]. GeoLocs, Xpoint, and Radar all use GeoComply's 12-phase onboarding as a sales tool. Accelerate int v2 / self-service onboarding.
  5. Brazil Superbet [HIGH]. Use the RDP failure as a compliance data point in any Brazil operator conversation.
  6. GeoVerify BLE pairing [HIGH]. If GeoVerify achieves US state regulatory approval it closes the desktop gap. No evidence yet — test as soon as it's available.
  7. US state-lottery expansion [HIGH]. Arizona + Kansas via mkodo's lottery-app relationships, not standalone geo sales. Assess whether state lottery bodies are an opportunity for us or structurally locked.
  8. SDK access gap [MEDIUM]. Gated; near-border pass rate is the single most critical unknown — test ASAP.