4 posts tagged with "fanatics-tn"

Source. June 8, 2026 weekly sync.
Ticket. CIV-89: Fanatics / OpenBet Locator — spoofing testing updates.

What we tested​

The Tennessee half of the Fanatics remote-access retest: HopToDesk remote control on Android against the Fanatics TN app (OpenBet Locator), with the remote operator driving the in-state device.

What happened​

• ⚠️ Remote-control session established. HopToDesk connected and the remote operator had full control of the Android device — the session itself was not blocked.
• ✓ Place Bet button hidden from the remote operator. Bets could not be placed remotely without local (in-person) interaction on the device.

Why it matters​

A partial outcome. The remote-access tool was not detected or blocked outright, but the wagering action was withheld from the remote session, so the fraud could not be completed remotely. The protection is not consistent across states and tools, though: on Fanatics MI this week, TeamViewer screen mirroring allowed full remote betting from Tennessee. An attacker who can supply even brief local interaction — or who finds a tool/state combination without the hidden-button behaviour — may still get through.

Cross-reference​

• Fanatics MI (OpenBet) — GPS simulator + TeamViewer screen mirroring undetected, bets placed from Tennessee (CIV-89) — the Michigan half of the same retest, where remote betting did succeed.
• Fanatics MI (OpenBet) — HopToDesk undetected on Android; TeamViewer + AnyDesk blocked (June 2, CIV-64) — HopToDesk on Android in Michigan a cycle earlier, where it slipped through at install and during an active session.

OpenBet profile → · June 8 weekly sync →

Source. May 19, 2026 weekly sync.
Ticket. CIV-59: Fanatics — OpenBet Locator | adv spoofing.

What we tested​

Close-to-border testing of the Fanatics (OpenBet Locator) deployment on iOS. The tester opened a West Virginia casino game session inside WV, then physically crossed into Virginia while keeping the session active.

What happened​

• Session maintained. The active WV casino-game session was held open consistently while the tester stood 10 meters inside the Virginia border — a state where the operator is not licensed.
• iOS only. The issue was not reproduced on Android in the same conditions.

Why it matters​

A 10m post-border allowance is meaningful in real-world geographies where homes, hotels, parking lots, and businesses sit directly on the state line. A player who lives or works on the line can sustain an active gaming session while physically on the wrong side of it. This is the exact compliance scenario near-border buffer zones exist to prevent.

The iOS/Android asymmetry suggests the regression is in the iOS-side boundary handling specifically, not in the underlying geofence geometry.

Cross-reference​

• OpenBet near-border has been a documented gap since May 5 — see Fanatics TN border-jumping + zero buffer (May 5). The May 19 finding gives us a precise, reproducible measurement (10m, iOS) to anchor that.
• Compare with the DraftKings DFS NJ post-border lag of 100–150m on Radar this week — different problem (session-state lag vs no buffer), same UX outcome (active session past the line).

OpenBet profile → · May 19 weekly sync →

Source. May 19, 2026 weekly sync.
Ticket. CIV-48.

What we tested​

The same hardware GPS simulator accessory used against Bet365 MI (Radar) and RSI BetRivers TN (XPoint) this week — applied to the Fanatics Tennessee (OpenBet Locator) deployment.

What happened​

Detected and named. The GPS simulator triggered a clear, specific error message:

"Your location has abruptly changed. Please disable apps that alter your device's location and retry."

This is notably more informative than the generic messaging seen at the other operators in the same test cycle — it tells the player exactly what kind of tampering was detected and what to do.

Why it matters​

Two things are worth recording here:

1. OpenBet handles GPS-simulator hardware. This is the third spoofing vector this week where OpenBet's detection held while Radar / XPoint's did not (alongside droidVNC-NG RDP blocked at Fanatics NJ and PlayCover blocked at Fanatics TN).
2. The UX is materially better. Compare with Radar's generic "Account Locked" messaging on DraftKings DFS NJ this week — same kind of compliance event, two very different player experiences. Specific, actionable error messaging reduces support load and shortens the recovery path for legitimate users.

Cross-reference (GPS simulator across providers this week)​

Operator	Provider	Result
Bet365 MI	Radar	✗ Bypassed via re-entry
RSI BetRivers TN	XPoint	✗ Fully undetected
Fanatics TN	OpenBet Locator	✓ Detected with specific error (this finding)

OpenBet was the only provider to handle this vector cleanly this cycle.

OpenBet profile → · May 19 weekly sync →

Source. May 19, 2026 weekly sync.
Ticket. CIV-59: Fanatics — OpenBet Locator | adv spoofing.

What we tested​

Remote-control testing against the Fanatics Tennessee (OpenBet Locator) deployment, comparing two screen-mirroring tools:

1. TeamViewer — desktop remote control, tester in NY driving a device located in TN.
2. FaceTime — same setup, Apple's native screen-sharing.

What happened​

• TeamViewer: not detected. The NY tester placed bets on the TN platform via TeamViewer screen mirroring with no error, restriction, or session interruption.
• FaceTime: detected and blocked correctly. Same operator, same jurisdiction, same testing setup — but the FaceTime session was identified and blocked.

Why it matters​

OpenBet Locator's RDP coverage is inconsistent by tool, not by operator or by platform. Some screen-mirroring tools are caught (FaceTime, droidVNC-NG at Fanatics NJ this week), others are not (TeamViewer here, HopToDesk + iPhone mirroring from May 5).

This is the same structural pattern we documented in earlier weeks: the remedial-action classes claim screen-share detection, but the detection runs against a fixed list of known signatures rather than generalising. Any RDP tool not in that list sails through.

Cross-reference​

• HopToDesk + iPhone screen mirroring at Fanatics TN (May 5) — earlier finding, same operator, same kind of gap.
• droidVNC-NG blocked and named at Fanatics NJ (this week) — positive counter-example, same operator footprint.
• Bet365 NJ (Radar) Tailscale + RealVNC undetected for 25 minutes (this week) — comparable bypass on a different provider.

OpenBet profile → · May 19 weekly sync →