How a Zentoria-facing payment façade, a concentrated NALMI infrastructure environment and a multi-brand casino platform layer may fit together — and what regulators, banks and PSPs should ask next.
2-Minutes Briefing
This Explainer Compliance Report translates the findings in the recently published compliance report into a plain-English network model. It explains Zentoria / Spinsopotamia as the EU-facing front-door layer, NALMI as the infrastructure envelope, and the wider casino-domain ecosystem as a multi-brand platform environment with recurring configuration, API, telemetry and application-build similarities. The report identifies key disclosure targets for regulators, payment providers and banks.
FinTelegram has been tracking how Zentoria Limited, an Irish-registered gambling-sector entity, and its public-facing domain Spinsopotamia.com appear in connection with offshore casino brands, player deposits and payment descriptors. Earlier reporting focused primarily on the payments side: player statements, casino cashier flows, possible merchant descriptors and the question whether a clean EU-facing entity was being used as a payment façade for higher-risk offshore gambling brands.
A new technical evidence package prepared by an external network engineer working with FinTelegram adds a different layer: infrastructure and platform correlation.
The core finding is not that Zentoria has been proven to own a large casino network. Nor is it that NALMI has been proven to operate illegal casinos. The stronger and more defensible point is narrower but highly significant:
The Zentoria-facing Spinsopotamia.com anchor is technically located inside the same concentrated NALMI / AS213846 infrastructure environment as hundreds of casino-related domains, many of which also show repeated configuration, API, telemetry and application-build similarities.
In plain English: Spinsopotamia does not look like an isolated casino website. It appears to sit inside or alongside a broader technical environment used by a large population of casino domains. That matters for regulators, banks, acquirers, wallet providers and payment institutions because it raises a simple due-diligence question:
When a payment provider onboards or services a merchant such as Zentoria / Spinsopotamia, is it reviewing only the visible front door — or the wider casino infrastructure and operational ecosystem behind it?
This report explains the model in non-technical terms.
Go to the Zentoria / NALMI Compliance Report!
Key Takeaways
- Zentoria / Spinsopotamia appears as the EU-facing front-door layer. FinTelegram’s prior reporting links Zentoria and Spinsopotamia to payment-descriptor and offshore-casino questions. The new report explains why that front-door role matters for PSPs, acquirers and banks.
- NALMI appears as the infrastructure envelope. The technical evidence places almost the entire investigated casino-domain population inside the same NALMI / AS213846 network environment. This does not prove ownership, but it creates a highly relevant disclosure target.
- The wider casino ecosystem shows platform-like patterns. Repeated configuration markers, API dependencies, telemetry signals and byte-identical application assets suggest a shared or templated technical environment behind multiple casino brands.
- The evidence challenges the “isolated website” explanation. The strongest defensible conclusion is not that Zentoria owns the wider network, but that Spinsopotamia does not appear technically isolated from the broader casino-domain environment.
- Provider-level records are now decisive. Infrastructure, edge, platform, telemetry, support and payment providers may hold the records needed to determine account ownership, tenant control, payment routing and settlement beneficiaries.
1. The Compliance Question
The Zentoria / NALMI case should not be understood as a purely technical matter. It is a compliance architecture problem.
In offshore gambling, the public-facing casino brand, the legal operator, the payment descriptor, the cashier provider, the platform operator and the hosting infrastructure are often separated across different jurisdictions and different entities. This fragmentation can make regulatory responsibility difficult to identify.
A player may believe they are depositing into one casino brand. Their bank statement may show another name. The website may display a licensed or legitimate-looking front. The payment may be processed through yet another provider. The technical infrastructure may support dozens or hundreds of related casino domains.
That is the risk model FinTelegram is investigating. The key question is not only “Who owns the casino?” but also:
Who provides the front door, who provides the building, who provides the service corridors, and who moves the money?
2. Who Is Zentoria?
In FinTelegram’s reporting, Zentoria Limited has emerged as a key EU-facing entity in the NovaForge / offshore casino context. Zentoria has been associated with Spinsopotamia.com, a domain that has reportedly appeared as a descriptor or public-facing anchor in connection with player deposits into offshore casino brands.
For compliance purposes, Zentoria matters because it represents the layer that can appear legitimate to banks, acquirers and payment processors:
- an EU-registered company;
- a gambling-sector activity profile;
- a public-facing domain;
- a descriptor that may appear on payment statements;
- and a cleaner presentation than the offshore casino brands receiving the player traffic.
This does not by itself prove wrongdoing. A licensed or registered gambling-related entity can operate lawfully. However, where such an entity appears in connection with deposits into offshore or blacklisted casino brands, the compliance question becomes more serious.
In this model, Zentoria / Spinsopotamia can be understood as the front-door layer. It is the visible name, the payment-facing wrapper and the apparently cleaner interface through which a higher-risk gambling ecosystem may access regulated financial rails.
3. Who Is NALMI?
NALMI Limited / AS213846 appears in the technical evidence as the infrastructure environment where the overwhelming majority of the investigated casino-related domains are concentrated. The external technical report reviewed 496 casino-related domains. According to the evidence package, 495 of those domains were located inside the same routed network range:
185.207.196.0/22 — AS213846 / NALMI Limited
Spinsopotamia.com was also observed within this same wider /22 environment.
This does not mean NALMI is necessarily the owner or operator of all those casino domains. Hosting and routing providers can serve multiple customers. Infrastructure concentration is not the same as legal ownership.
But from a compliance perspective, NALMI is highly relevant because it appears to provide or route the technical building in which the casino-domain population is concentrated.
A simple analogy helps:
NALMI is not necessarily the shop owner. It may be the building, the address system or the technical landlord. But hundreds of casino-related doors appear to be located in that same building.
That is why regulators and payment providers should care.
4. The Network in Plain English
The technical evidence can be simplified into a four-layer model.
Layer 1 — The Front Door: Zentoria / Spinsopotamia
This is the layer visible to users, banks or payment institutions. It may appear as a website, descriptor, merchant reference or legal entity.
In this model, Spinsopotamia.com is the public-facing anchor and Zentoria Limited is the entity associated with that anchor in FinTelegram’s reporting.
Layer 2 — The Casino Brand Layer
This is the layer of outward-facing casino brands: names, skins, replacement domains, mirror domains and campaign domains. These brands may look separate to players. They may use different names, designs or landing pages.
But technical evidence suggests that many such domains may not be truly independent at the infrastructure or platform level.
Layer 3 — The Service Corridor
Behind the public casino brands, there appears to be a shared or templated service environment. This is where the technical evidence becomes important. The reports identify repeated elements such as:
- shared configuration markers;
- repeated fraud and telemetry endpoints;
- cross-domain API dependencies;
- canonical and alternate API hosts;
- recurring support and analytics services;
- and byte-identical application assets.
In non-technical language, this is the service corridor behind the casino doors. Different casino brands may appear separate from the outside, but behind the scenes they may be using common pipes, common back-office tools, common technical configurations or a common platform provider.
Layer 4 — The Infrastructure Building: NALMI
This is the network layer. The evidence places almost the entire investigated domain population inside the same NALMI / AS213846 network envelope.
This does not answer the ownership question, but it gives regulators a compact target area for disclosure requests.
5. What the Technical Evidence Adds
The technical evidence supplied to FinTelegram is important because it does not rely on branding impressions, website similarity or speculation. It relies on public-source technical artefacts.
The most important findings are:
5.1 The NALMI Concentration
The reviewed dataset contains 496 investigated casino-related domains. According to the evidence package, 495 were located inside the same NALMI / AS213846 network range.
Spinsopotamia.com, the Zentoria-facing anchor, was also observed inside that same routed environment.
This creates a strong infrastructure bridge between the Zentoria-facing front door and the wider casino-domain population.
5.2 The 83-Domain Configuration Cluster
A narrower cluster of 83 domains showed repeated configuration markers across preserved public pages. These included the same CSP reporting endpoint, the same SEON fraud/device-intelligence token, a repeated non-financial promotion-response hash and the same NALMI network envelope.
This is materially stronger than simply saying that many sites use the same cloud provider. These are account- or project-style markers that can point to a shared configuration environment.
5.3 The API and Mirror-Domain Pattern
The evidence also identifies a structure in which public-facing domains call other canonical or alternate API hosts. This pattern is consistent with rotating façade domains and central backend services.
In plain English: the visible casino domain may not be the real operational centre. It may be a shop window that connects to another technical host behind the scenes.
5.4 Byte-Identical Application Assets
The consolidated report identifies 120 meaningful byte-identical asset groups connecting 98 domains into 16 technical components.
This means that many outwardly separate casino domains delivered identical pieces of first-party application code. That is a classic sign of a shared deployment pipeline, shared platform template or centrally managed casino software environment.
5.5 Telemetry, Support and Service Reuse
The reports also identify repeated use of analytics, fraud-intelligence, session-replay, support and platform-related services across the domain population.
Again, the significance is not that every provider acted unlawfully. The significance is that these providers may hold the account-level records that can resolve the attribution question.
6. What Role Does Zentoria Appear to Play?
Based on the evidence currently available, the safest formulation is:
Zentoria appears to be the EU-facing public and payment-facing anchor in a broader casino-payment and infrastructure environment.
That does not mean Zentoria has been proven to own all related casino brands. It does not mean Zentoria controls the NALMI network. It does not mean every brand in the wider cluster is legally operated by Zentoria.
But it does mean that Zentoria / Spinsopotamia is not merely a random name in the story. It appears at the front end of the compliance problem: the point where a player, a bank, a payment institution or an acquirer may see a cleaner descriptor or a more conventional gambling-sector entity.
In the network model, Zentoria is best described as:
the clean front-door layer.
That is a critical role. In high-risk payment ecosystems, the front-door layer can determine whether a transaction is accepted, how it is described, how it is monitored and whether a bank or acquirer understands the true risk profile of the underlying merchant activity.
7. What Role Does NALMI Appear to Play?
NALMI appears to be the infrastructure envelope.
The evidence places hundreds of casino-related domains inside the NALMI / AS213846 185.207.196.0/22 network environment. This makes NALMI a key infrastructure disclosure target.
But it is important not to overstate the point. The evidence does not prove that NALMI is the casino operator. It does not prove that NALMI owns the casino brands. It does not prove that NALMI designed the payment structure.
What it does show is that the casino-domain population is highly concentrated in a technical environment associated with NALMI. That gives regulators and compliance teams a focused place to ask questions:
- Who controls the relevant server allocations?
- Which customer accounts were assigned to the domains?
- Were the domains provisioned for one customer or many?
- Were abuse complaints received?
- Did the same customer account control both the larger casino-domain population and the Spinsopotamia endpoint?
In the network model, NALMI is best described as:
the technical building or infrastructure layer.
8. The Missing Middle: Platform and Operations
The most important unresolved layer is the middle layer between Zentoria and NALMI.
This is the platform and operations layer. It may include:
- casino software providers;
- API host operators;
- support and CRM tenants;
- analytics and telemetry accounts;
- fraud-screening accounts;
- cashier and wallet providers;
- payment gateways and acquirers;
- affiliate and campaign operators;
- domain managers;
- and whoever controls deployment and configuration.
This is where legal attribution will likely be resolved.
Public-source evidence can show that many doors lead into the same building and that many shops use similar tools. It cannot always identify who signed the lease, who paid the invoices, who controlled the admin panel or who received the settlement funds.
That is why provider-side disclosure is essential.
9. Why This Matters for Regulators and Payment Providers
The Zentoria / NALMI case illustrates a broader problem in online gambling compliance.
Traditional merchant due diligence often looks at the visible merchant:
- the company name;
- the registered address;
- the licence or registration;
- the website shown at onboarding;
- and the descriptor shown to card networks or banks.
But modern offshore casino ecosystems may be layered. A clean merchant descriptor can sit in front of offshore brands. A licensed or registered entity can be used as a payment-facing wrapper. A large number of casino domains can rotate through shared infrastructure. Payment flows can be separated from brand ownership. Platform providers can centralise the real operating environment.
This means that onboarding a merchant such as Zentoria / Spinsopotamia cannot stop at checking one website.
A serious compliance review should ask:
- Which casino brands are actually funded through this merchant?
- Which descriptors appear on player statements?
- Which domains share the same cashier, support or platform environment?
- Which infrastructure provider hosts or routes the related domains?
- Which payment gateways, wallet providers, MIDs and acquirers are used?
- Who is the ultimate settlement beneficiary?
- Are players in restricted jurisdictions being accepted?
- Are offshore casino deposits being presented under a cleaner EU-facing descriptor?
These are not technical questions. They are standard AML, merchant-risk and gambling-compliance questions.
10. What This Report Does Not Say
This report does not claim that Zentoria owns the NALMI casino network.
It does not claim that NALMI operates illegal casinos.
It does not claim that every domain in the wider infrastructure population has the same legal owner or ultimate beneficial owner.
It does not claim that every provider detected in the technical evidence knowingly facilitated unlawful activity.
It does not establish criminal liability, regulatory breach or civil liability as a matter of law.
The evidence is technical and operational. It shows infrastructure concentration, configuration reuse, API relationships, application-build similarities and provider footprints. Final legal attribution requires provider records, payment records, corporate records and assessment by competent regulators.
That boundary matters. It is also what makes the evidence stronger.
11. The Strongest Defensible Conclusion
The strongest defensible conclusion is this:
The technical evidence does not prove that Zentoria owns the NALMI casino network. But it makes one proposition increasingly difficult to sustain: that Spinsopotamia is merely an isolated, standalone casino site with no meaningful connection to the wider offshore casino infrastructure around it.
The evidence instead points to a layered model:
- Zentoria / Spinsopotamia as the EU-facing and payment-facing front door;
- multiple casino brands and mirror domains as the visible brand layer;
- shared APIs, telemetry, support, fraud and application assets as the service corridor;
- and NALMI / AS213846 as the concentrated infrastructure building.
For regulators, banks and payment institutions, the message is simple:
Do not review the front door alone. Map the building, the corridors and the rails behind it.
12. Disclosure Targets
The next stage is not more speculation. It is disclosure.
The following parties or provider categories may hold the records needed to move from technical correlation to legal attribution:
| Disclosure Target | Records That Matter |
|---|---|
| Infrastructure provider / NALMI | Customer accounts, server allocations, billing contacts, abuse records, routing history |
| Edge / CDN provider | Zone ownership, DNS history, origin configuration, WAF and abuse records |
| Platform provider | Tenant ownership, brand IDs, deployment history, authorised users |
| Telemetry providers | Project ownership, masking settings, retention policies, authorised users |
| Support / CRM providers | Tenant ownership, support portals, ticket routing, sender verification |
| Payment / cashier providers | MIDs, gateway IDs, route IDs, acquirers, settlement beneficiaries |
| Banks and card acquirers | Merchant onboarding files, transaction monitoring records, descriptor approvals |
| Gambling regulators | Licence scope, operator responsibility, restricted-jurisdiction exposure |
13. Call for Information
FinTelegram invites whistleblowers, former employees, payment insiders, compliance officers, infrastructure specialists, affiliate managers, casino platform contractors and affected players to provide information about the Zentoria / Spinsopotamia / NALMI environment.
We are especially interested in:
- bank or card statements showing Spinsopotamia, Zentoria or related descriptors;
- cashier screenshots from Robycasino, Spinsy, Kingmaker, BillyBets, MyEmpire, DuoSpin or related brands;
- merchant receipts, checkout pages, gateway IDs or payment confirmation emails;
- internal onboarding or compliance files involving Zentoria, Spinsopotamia, NovaForge or related entities;
- provider records linking domains, tenants, support portals or telemetry accounts;
- information about the NALMI-hosted casino-domain environment;
- records identifying the settlement beneficiaries behind the relevant payment flows.
Information can be shared confidentially with FinTelegram via Whistle42.
14. Right of Reply
FinTelegram invites Zentoria Limited, NALMI Limited, relevant platform providers, payment processors, acquirers, wallet providers, support providers, telemetry providers and any named or indirectly referenced party to provide clarification, corrections or documentary evidence.
FinTelegram will review substantiated responses and update its reporting where appropriate.
This report is published in the public interest as a compliance intelligence analysis. It is based on public-source technical evidence, prior FinTelegram reporting and whistleblower-supported research. No finding of unlawful conduct is made against any person, provider or company without further provider-level and regulatory confirmation.
