Skip to main content

Competitive Intelligence — Weekly Sync

📅 Week 8 — May 19, 2026 · ⏱ 30 minutes · 👥 Weekly cadence

Agenda​

#Topic
1Competitive and Client Testing — Key Findings
2Competitive Research — Key Findings
3Win/Loss — Competitive Win-Backs (Salesforce)
4Social Media — Key Findings
5What's Next — Open Planning

1 · Competitive and Client Testing (Julia) — Key Findings​

Confirmed compliance vulnerabilities — GPS Simulator bypass​

  • ✗ Bet365 MI (Radar) — GPS simulator bypass, re-entry restriction not re-applied
    Hardware GPS simulator accessory spoofed the tester's physical location. After an initial login error, a second login attempt succeeded with no further location checks enforced. Real-money bets placed from Tennessee on the MI casino. Restriction not re-applied on re-entry — repeatable compliance gap.
    🎫 CIV-48 — Test Fake Location using GPS Simulator Accessory on Competitor Apps
  • ✗ RSI BetRivers TN (XPoint) — GPS simulator fully undetected
    Hardware GPS simulator went fully undetected. Tester logged into the Michigan app from Tennessee and played a casino game with no errors or restrictions triggered.
    🎫 CIV-48

Confirmed compliance vulnerabilities — Remote Desktop undetected​

  • ✗ Bet365 NJ (Radar) — Tailscale + RealVNC undetected for 25+ minutes
    Mac remotely controlled an Android device on a separate network via Tailscale + RealVNC. Tester placed bets continuously for over 25 minutes with no interruptions, timeouts, or restrictions. Radar's geolocation checks did not detect the remote session at any point.
    🎫 CIV-69 — Bet365 NJ — RDP Testing on Android
  • ✗ RSI BetRivers NJ (XPoint) — Tailscale RDP fails detection, inconsistent when it triggers
    XPoint fails to detect Tailscale-based remote access in most cases, allowing bets from a physically separate location. When detection did occur it was inconsistent and easily bypassed by logging out and back in. Two attack methods confirmed — one requiring brief one-time approval, one fully unattended.
    🎫 CIV-73 — BetRivers NJ — RDP via macOS

Confirmed compliance vulnerability — Resigned iOS app​

  • ✗ Bet Saracen AR (Radar) — modified ("resigned") iOS app placed bets from Michigan
    A modified version of the Bet Saracen iOS app — altered to remove Apple's integrity protections — was used to place bets remotely from Michigan with no issues. The same account on the unmodified app was correctly blocked. Direct fraud and compliance risk: bad actors can use modified apps to bet from any location.
    🎫 CIV-44 — Saracen Arkansas — Radar: verify the wagering experience for static connection closer to the border

Confirmed compliance vulnerabilities — Fanatics TN (OpenBet Locator)​

DraftKings DFS NJ (Radar) — full integration validation results​

  • ✗ DraftKings DFS NJ (Radar) — RDP inconsistent, cross-border lag, generic UX
    Full validation of the post-migration integration:
    • RDP detection: inconsistent. Zoom and AnyDesk NOT detected during active remote sessions. TeamViewer blocked in initial testing (May 8) but went undetected in two retests on May 13–14 — unreliable detection behaviour.
    • Cross-border session lag: ~100–150m past the PA→NJ state border (vs GeoComply's 2–5m range). Users entering NJ without a prior PA session were unaffected — points to a session-state issue on the provider side.
    • Generic error messaging. Both RDP detection and cross-border blocking surface a generic "Account Locked" message with no user guidance.
      🎫 CIV-65 — DraftKings DFS — validate the competitor's integration

Unsuccessful spoofing methods (positive results)​

Man-in-the-Middle attack testing​

  • ✓ RobinHood TN — SSL certificate pinning blocks network interception on iOS + Android
    Charles Proxy was unable to capture any geolocation-related traffic on iOS. On Android, mitmproxy produced a TLS handshake failure, rendering the app unusable for interception. Note: RobinHood does not use a device-level geolocation SDK — location verification is IP-based only. While MITM protection is in place, the overall compliance posture remains significantly weaker than SDK-based solutions.
    🎫 CIV-60 — RobinHood — RAT

2 · Competitive Research (Valeria) — Key Findings​

Placeholder — Valeria to add.

3 · End-user Feedback (Valeria) — Key Findings​

📊 Full dataset: Social Media Competitive Signals · Reddit + X/Twitter public posts. Monitoring initiated March 2026.

Placeholder — Valeria to add.

4 · What's Next — Plan for Next Week​

Field Testing​

  • Bet365 NJ (Radar) — full validation following the confirmed RDP gap
  • Fanatics TN (OpenBet Locator) — Rooted Android / Hidden Root, Jailbroken iOS — all test accounts blocked (verify scope)
  • Alberta launch — test competitors on the market (GeoLocs / Mkodo)
  • Saracen AR (Radar) — RAT (?), RDP

Betting Hero​

  • Bet365 MI — full Radar / XPoint integration research
  • Fanatics MI (OpenBet Locator) — RDP retest, VMOS (needs training of the BH team)
  • P0 — Saracen AR (Radar Verify app, retest) — conduct full competitor validation

Integrations team​

  • TBD

All findings this week​

Competitor profiles​

Radar → · Xpoint → · OpenBet → · GeoLocs → · Locance →