GAMRS report: "Hydra model" offshore operation anatomy
A new report from GAMRS (powered by Deal Me Out) documents how an offshore network, attributed to Santeda International B.V. and Ryker B.V., operates unauthorized online casino brands in the United Kingdom, focusing on MyStake and a set of connected domains and “satellite brands” (Cosmobet, Velobet, Goldenbet, Rolletto, Donbet, among others). The value of the report lies not only in the estimated volume but in the method: an architecture designed to withstand blocks, hide operational control, and maintain the flow of deposits through intermediaries, aggressive affiliation, and domain rotation.
1) The data that size up the case (according to GAMRS)
GAMRS claims to have collected evidence from 96 verified testimonies of UK residents, supported by documentation (bank records, payment confirmations, account histories, and communications with the operator). Within that group, the report states verified losses of £241,152 attributed to MyStake. It also mentions episodes of losses in very short windows, including cases of tens of thousands of pounds in a few days, along with accounts of self-exclusion attempts and seeking harm reduction tools.
In parallel, the report includes a “conservative” modeling exercise of the business size, clarifying that the figures are turnover estimates, not profit. Within this framework, GAMRS estimates:
- MyStake alone, more than £1.2 billion in annual turnover.
- The network of brands associated with Santeda, around £3.5 billion in annual turnover.
- Approximately 64% of the volume would derive from consumers in the UK, equivalent to £2.0 to £2.2 billion in UK-sourced annual turnover.
2) How a modern offshore network operates, the “Hydra model”
The report describes a resilience strategy called “Hydra”: when a domain loses operational capacity (due to provider withdrawal, regulatory pressure, or ISP or payment blocking), the network does not stop, it multiplies. The key is that the “heads” (domains, skins, brands) are interchangeable and share backend, affiliates, game libraries, and payment rails.
2.1 Domains with different roles, “funnel” vs “hub”
GAMRS maintains that some brands function as acquisition surfaces (funnels), aimed at capturing traffic and redirecting it, with low retention and high bounce metrics, while the real gaming “hub” shows long sessions and many pages per visit. In the report, MyStake appears as the engagement hub, and Cosmobet or Velobet as feeder sites that absorb traffic when the main domain weakens.
2.2 Express substitution and “replacement shells”
Another described tactic is the deployment of placeholder pages or temporary “shells” that keep a domain alive to avoid losing SEO, authority, and affiliate funnels while the operation behind is rebuilt. The goal is traffic continuity, not gaming experience on that specific domain.
3) The technological layer, why the platform provider matters
A central finding of the report is the technical attribution to the Upgaming / InPlayNet ecosystem. GAMRS describes infrastructure matches, configuration footprints, and shared elements (for example, support identifiers and integration patterns) that point to unified technical control among multiple brands. The report suggests that the regulatory “facade” relies on offshore licenses, while operational control and part of the daily command would be concentrated in Georgia, with a corporate structure distributed across multiple jurisdictions.
It also mentions a particularly relevant element for digital attribution: a TLS layer inspection where “Hydra” domains appear anchored to historical infrastructure linked to InPlayNet, the former name associated with Upgaming, which for the report suggests technical continuity beyond rebranding.
4) Payments, the most critical point, “appearing non-gambling”
The report describes a multi-jurisdictional payment infrastructure that would allow deposits with UK cards, e-wallets, and crypto, which then “travel” through layers to dilute the gambling origin trail.
The flow, according to GAMRS, combines:
- High-risk processors and transfer routings,
- the use of EMIs (for example, Clear Junction is cited as an EMI regulated in the UK),
- payment agents in Cyprus (corporate vehicles that invoice and route),
- and a processing layer in Georgia, where some movements could be reclassified as payments for IT services, consulting, or loans, gaining transactional opacity.
The practical conclusion is clear: even if “formal” institutions are not accused of misconduct, the combination of intermediaries and “re-labeling” of payments allows an offshore operation to sustain deposits from restricted markets.
5) Affiliation and marketing, the engine that recruits and re-engages
GAMRS places much of the growth on the layer of affiliates and routing. The report describes:
- Redirection systems that detect GEO, device, fingerprint, and automatically select mirror domain, fallback, or even another brand of the same group, making domain blocking insufficient.
- Deliberate promotion toward “Non-Gamstop” type searches, aimed at capturing self-excluded users, a particularly sensitive point from a responsible gaming perspective.
- Play-money streaming practices, where creators stream with non-withdrawable funds, reducing risk perception and pushing conversion to real deposits, according to the report.
The document also mentions intervention actions, such as the removal of dozens of promotional contents that directed traffic to unauthorized operators, as an example that the affiliate vector can be attacked but requires sustained effort.
6) Branding and “IP washing,” legitimacy through trademark registration
A little-discussed point outside regulatory environments but very powerful is the use of trademarks as a legitimization tool. GAMRS cites registrations in EUIPO and UKIPO for a set of associated brands, under structures that, according to the report, show legal coordination and portfolio continuity. The logic: although the gaming is offshore, trademark registration in “premium” jurisdictions projects legitimacy, protects naming, and facilitates quick rebranding after enforcement actions.
7) Signs of “manufactured reputation,” fake executives and synthetic PR
The report describes a frequent tactic in offshore networks: building “credentials” with low-quality PR, dubious awards, and executive profiles that would function as reputational decoys. In the MyStake case, GAMRS claims a CEO figure was promoted that shows signs of a synthetic or fabricated person. The goal is not to convince a regulator but to dominate search results and sow doubt when real attribution is attempted.
8) What this case teaches us about offshore, and what the industry should watch
This report, beyond the specific case, summarizes the operational pattern of many relevant offshore networks today:
- Domain is not company, the business is a network of skins
- Blocking one domain only pushes traffic to other nodes.
- Supply chain rules, platform, aggregators, PSPs, affiliates, hosting
- If the supply chain keeps providing services, the “Hydra” regenerates.
- Payments are the real bottleneck
- The operation survives as long as it can collect, even if “disguising” the nature of the transaction.
- Modern attribution is technical, not declarative
- Shared IDs, configuration footprints, support and routing patterns sometimes say more than an “About us.”
- Responsible gaming and compliance become asymmetric
- Offshore competes with less friction, more incentives, fewer controls, and that changes the economics of the regulated market.
You can see the full report prepared by GAMRS here.
Tags: United Kingdom, offshore casinos, how an offshore casino operates, GAMRS report