Phishing & fraudmedium
Traffer teams sell fake prediction-market fraud kits
Original title: Prediction Markets Emerge as a New Vertical for Traffer Teams
AI summary · x-ai/grok-4.7Summaries by Vani AI
AtlasCore, PolyFucked, and Magnetic Team supply scam sites, panels, and crypto payouts; deposit totals are unverified.
Insikt Group says Russian-language traffer teams have since spring 2026 adapted affiliate fraud to imitation prediction markets such as Polymarket and Kalshi. AtlasCore, PolyFucked, and Magnetic Team offer websites, admin panels, crypto payments, victim management, and promotional support, with forced wins or losses, withdrawal blocks, and collection of identity and payment data. AI is used for support, promo content, and possibly platform development. Insikt Group tied more than 100 domains and subdomains to the three teams or their affiliates.
Unconfirmed: Deposit and turnover totals rely on threat-actor reporting and are unverified; AI-built Magnetic Team code is unconfirmed.
Key facts
- Affiliate shares advertised at 70–80% for AtlasCore, at least 60% for PolyFucked, and 70% for Magnetic Team.
- AtlasCore Telegram posts claim about $10.97 million in deposits from May 2 to September 18, 2026.
- PolyFucked advertises about $2.4 million in quarterly turnover.
- Magnetic Team advertises more than 3,000 simulated traders across more than 5,000 markets.
- Over 100 unique domains and subdomains were linked to the three teams.
Security assessment · AI, from the article
Impact: Victims lose deposits and identity and payment data
What to do
- 1.Treat unsolicited prediction-market sites imitating Polymarket or Kalshi as possible affiliate scams.
- 2.Avoid depositing crypto or identity documents on sites that block withdrawals or force outcomes.
- ATT&CK
- T1583.001 Acquire Infrastructure: DomainsT1036 MasqueradingT1589 Gather Victim Identity Information
- Products
- PolymarketKalshi
- Threat actors
- AtlasCorePolyFuckedMagnetic Team
- Organizations
- Insikt Group
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | atlascore-panel.net | at this time, affiliates gain access to the panel hosted at atlascore-panel[.]net ; the sub-teams are hosted at polymarket[.]atlascore-pane |
| domain | bravioar.com | nclude speculor[.]net , rqwrujarser[.]icu , wettora[.]com , bravioar[.]com , and winzo[.]live ; these domains hosted casino-, exchan |
| domain | casino.atlascore-panel.net | -teams are hosted at polymarket[.]atlascore-panel[.]net and casino[.]atlascore-panel[.]net , and require separate applications and credentials for |
| domain | docs.atlascore-panel.net | als for joining. The team also hosts several manuals at the docs[.]atlascore-panel[.]net subdomain. The manuals include guidance for working wit |
| domain | event-x.cc | , and its IP address is currently hidden behind Cloudflare. event-x[.]cc : This domain was most recently registered on July 14, 20 |
| domain | luxproxy.cc | ffiliates use a mobile proxy purchased through the services luxproxy[.]cc , proxy-store[.]cc , or proxy-seller[.]com . The manuals |
| domain | polyfucker.space | withdrawals. Figure 7: PolyFucked affiliate panel hosted at polyfucker[.]space (Source: Recorded Future) PolyFucked advertises a minimum |
| domain | polymarket.atlascore-panel.net | sted at atlascore-panel[.]net ; the sub-teams are hosted at polymarket[.]atlascore-panel[.]net and casino[.]atlascore-panel[.]net , and require separa |
| domain | prdct.cc | obtained via DomainTools and the Recorded Future platform: prdct[.]cc : This domain was most recently registered on August 10, |
| domain | predicate.cc | eting this domain, along with offers of $1,000 for joining. predicate[.]cc : This domain was most recently registered on May 21, 202 |
| domain | predicate.club | 31, 2026), and predicate[.]live (first seen July 22, 2026). predicate[.]club : This domain was most recently registered on August 12, |
| domain | predicate.live | 5, 2026), predicate[.]world (first seen July 31, 2026), and predicate[.]live (first seen July 22, 2026). predicate[.]club : This domai |
| domain | predicate.world | bsite title: predictedby[.]cc (first seen August 15, 2026), predicate[.]world (first seen July 31, 2026), and predicate[.]live (first s |
| domain | predictedby.cc | three additional domains that share the same website title: predictedby[.]cc (first seen August 15, 2026), predicate[.]world (first se |
| domain | predictum.app | identify an additional ten domains hosting similar content. predictum[.]app : This domain was most recently registered on August 12, |
| domain | predictum.cc | ains that share the same website title: predictum[.]pro and predictum[.]cc . The panel also contains several example webpages, hoste |
| domain | predictum.pro | d two additional domains that share the same website title: predictum[.]pro and predictum[.]cc . The panel also contains several exam |
| domain | proxy-seller.com | through the services luxproxy[.]cc , proxy-store[.]cc , or proxy-seller[.]com . The manuals also provide affiliates with instructions f |
| domain | proxy-store.cc | mobile proxy purchased through the services luxproxy[.]cc , proxy-store[.]cc , or proxy-seller[.]com . The manuals also provide affili |
| domain | quickblox.net | s associated with the email address austinhenderson199962[@]quickblox[.]net . As of August 8, 2026, this page displayed an error mess |
| domain | rqwrujarser.icu | ains hosted on the same IP address include speculor[.]net , rqwrujarser[.]icu , wettora[.]com , bravioar[.]com , and winzo[.]live ; the |
| domain | speculor.net | dflare. Other domains hosted on the same IP address include speculor[.]net , rqwrujarser[.]icu , wettora[.]com , bravioar[.]com , an |
| domain | testdomainatlas.com | The panel also contains several example webpages, hosted at testdomainatlas[.]com . According to open sources, this web page is associated |
| domain | wettora.com | ame IP address include speculor[.]net , rqwrujarser[.]icu , wettora[.]com , bravioar[.]com , and winzo[.]live ; these domains hoste |
| domain | winzo.live | , rqwrujarser[.]icu , wettora[.]com , bravioar[.]com , and winzo[.]live ; these domains hosted casino-, exchange-, and prediction |
| ipv4 | 192.162.199.243 | nd August 14, 2026, the domain was hosted at the IP address 192[.]162[.]199[.]243 ; after that, the domain moved behind Cloudflare. Oth |
From the original article
12 min read at recordedfuture.com
Discover how Russian traffer teams use turnkey fraud infrastructure to exploit prediction markets.
By Insikt Group® · recordedfuture.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.