Researchers Detail Three Traffer Teams’ Fake Prediction-Market Operations
Summary
Recorded Future details how AtlasCore, PolyFucked and Magnetic Team use fake prediction-market platforms to rig outcomes, block withdrawals and collect identity/payment data. They use AI for promotion and victim support; revenue figures and suspected AI-assisted code do
Key points
- Insikt Group identified AtlasCore, PolyFucked and Magnetic Team offering affiliates simulated prediction-market websites, administrative panels, cryptocurrency payments and promotional support.
- Analysis of platform code found controls to force wins or losses, fabricate trading activity, set fees and block withdrawals using staged pretexts.
- The fake platforms request payment-card details, identity documents and selfies through purported verification processes.
- Magnetic Team advertises more than 3,000 simulated traders across 5,000-plus markets; researchers found code supporting up to 20,000 deposit wallets per blockchain, with private keys exposed after a deposit.
- All three teams advertise or provide AI-assisted victim support. AtlasCore and PolyFucked provide guidance for AI-generated promotional content; Magnetic Team’s code may have been AI-assisted, but that assessment is unconfirmed.
- AtlasCore’s Telegram channel showed about $10.97 million in claimed deposits, while PolyFucked advertised about $2.4 million in quarterly turnover; the figures are unverified.
- Insikt Group identified more than 100 domains and subdomains associated with the three teams and their operations.
Article Details
- Attack Vectors
- Affiliates promote simulated prediction-market websites that imitate legitimate platforms and use fabricated trading activity and controlled outcomes to induce deposits.
- Operators use Instagram Reels and other social-media content, including synthetic influencer personas and trending-event videos, to attract potential victims.
- Fake market interfaces collect payment-card details and personal information, including identity-document images and selfies through purported KYC checks.
- The platforms block withdrawals using fabricated verification, fee, AML-review, or other pretexts, while encouraging further victim payments.
- Victim deposits are directed to cryptocurrency wallets; Magnetic Team's panel supports bulk-generated deposit wallets and private-key export for fund sweeping.
- AI-assisted support is used to engage victims, including generating replies and translating conversations.
- Defensive Notes
- Track shared code, infrastructure, cryptocurrency flows, and operator relationships across transient scam domains to identify continuity between campaigns.
- Monitor for prediction-market impersonation, fabricated market activity, and withdrawal demands framed as verification, fees, or account upgrades.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | atlascore-panel[.]net | AtlasCore affiliate administrative panel used to manage its scam offerings. |
| DOMAIN | btwoteam[.]xyz | Domain hosting content identical to Magnetic Team's predicton[.]org example site; previously hosted a TraffHub login panel. |
| DOMAIN | docs[.]atlascore-panel[.]net | AtlasCore-hosted manuals that instruct affiliates on promoting its scam offerings. |
| DOMAIN | event-x[.]cc | AtlasCore-associated scam domain observed connecting by WebSocket to its prediction-market panel. |
| DOMAIN | fortexp[.]live | Domain linked by Recorded Future data to the PolyFucked-associated forutsagt[.]bet infrastructure. |
| DOMAIN | fortvet[.]cc | Domain linked by Recorded Future data to the PolyFucked-associated forutsagt[.]bet infrastructure. |
| DOMAIN | forutsagt[.]bet | Domain linked by the article to PolyFucked-related prediction-market infrastructure. |
| DOMAIN | futaryx[.]com | Domain linked by Recorded Future data to the PolyFucked-associated forutsagt[.]bet infrastructure. |
| DOMAIN | kiro-cheap[.]pro | Domain linked by the article to PolyFucked-related scam infrastructure. |
| DOMAIN | magnetic-panel[.]space | Magnetic Team administrative panel used to manage its fraudulent prediction-market campaigns. |
| DOMAIN | polyfucker[.]space | PolyFucked affiliate administrative panel for its prediction-market scam operation. |
| DOMAIN | polymarket[.]atlascore-panel[.]net | AtlasCore prediction-market sub-team panel; the article also reports a WebSocket connection to it from event-x[.]cc. |
| DOMAIN | polymarket[.]casino | Domain reported as actively impersonating Polymarket and previously hosted on the same IP as Magnetic Team's panel. |
| DOMAIN | prdct[.]cc | Shared domain identified as part of AtlasCore's prediction-market scam infrastructure. |
| DOMAIN | predicate[.]cc | AtlasCore-associated fake prediction-market domain whose code exposes victim-facing scam functionality. |
| DOMAIN | predicate[.]club | AtlasCore-associated prediction-market scam domain whose code supports manipulated outcomes and withdrawal restrictions. |
| DOMAIN | predicate[.]live | Domain identified as sharing a website title with AtlasCore-associated prediction-market infrastructure. |
| DOMAIN | predicate[.]world | Domain identified as sharing a website title with AtlasCore-associated prediction-market infrastructure. |
| DOMAIN | predictedby[.]cc | Domain identified as sharing a website title with AtlasCore-associated prediction-market infrastructure. |
| DOMAIN | predicton[.]org | Magnetic Team example PredictON website shared with affiliates. |
| DOMAIN | predictum[.]app | Domain identified as part of AtlasCore's prediction-market scam infrastructure. |
| DOMAIN | predictum[.]cc | Domain identified as sharing a website title with AtlasCore-associated prediction-market infrastructure. |
| DOMAIN | predictum[.]pro | Domain identified as sharing a website title with AtlasCore-associated prediction-market infrastructure. |
| DOMAIN | preds[.]co | Shared domain offered by PolyFucked for its fraudulent prediction-market service. |
| DOMAIN | resolve[.]bet | Shared domain offered by PolyFucked for its fraudulent prediction-market service. |
| IPV4 | 192[.]162[.]199[.]243 | IP address that hosted AtlasCore-associated predicate[.]club. |
| IPV4 | 31[.]76[.]10[.]48 | IP address hosting Magnetic Team's magnetic-panel[.]space and previously used by its predicton[.]org example site. |
| IPV4 | 81[.]90[.]17[.]100 | IP address that hosted PolyFucked-linked forutsagt[.]bet and kiro-cheap[.]pro. |
| IPV4 | 83[.]217[.]208[.]78 | IP address that hosted PolyFucked-linked kiro-cheap[.]pro before it moved to other hosting. |
| IPV4 | 87[.]120[.]165[.]193 | IP address used by Magnetic Team's predicton[.]org example site after it moved from earlier hosting. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationThe article reports polymarket[.]casino actively impersonating Polymarket, and describes scam interfaces modeled on legitimate prediction-market platforms.T1056.003 · Web Portal CaptureFake prediction-market interfaces collect payment-card details and purported KYC data, including identity-document images and selfies.T1565.002 · Transmitted Data ManipulationOperators can set per-victim outcomes and win chances, including forced wins or losses, to manipulate simulated market results.T1583.001 · DomainsThe teams register and use domains for administrative panels and fraudulent prediction-market websites.T1585.001 · Social Media AccountsPolyFucked guidance describes warming new Instagram accounts and disguising them as ordinary creator profiles for scam promotion.T1657 · Financial TheftThe schemes collect victims' cryptocurrency deposits, and Magnetic Team's panel supports exposing deposit-wallet private keys for fund sweeping.
Threat Actors
after_dayInsikt Group reports that this user advertised PolyFucked and had previously tracked the user for operating After Change and advertising the After Drainer traffer offer.AtlasCoreInsikt Group reports that this traffer team supplies affiliates with prediction-market scam websites, administrative infrastructure, and promotional guidance.Magnetic TeamInsikt Group reports that this traffer team operates the PredictON scam platform, including manipulated trading outcomes, fabricated activity, and mechanisms to block victim withdrawals.MagneticCEOThe article identifies this user as advertising Magnetic Team on its behalf and as the owner and administrator of the team's Telegram channels.PolyFuckedInsikt Group reports that this traffer team provides affiliates with fraudulent prediction-market infrastructure, payment processing, and support.
Vendors
Products
Claude Sonnet 4The code authors recommend GPT-4o or Claude Sonnet 4 for responding to victims because these models retain conversational context and are less likely to produce repetitive responses, unlike cheaper models such as Qwen.DeepSeek ChatCheaper models, including GPT-4o Mini, Gemini 2.0 Flash, and DeepSeek Chat, are recommended for translating victim messages into Russian, enabling operators to monitor and engage in live interactions with victims acrossGemini 2.0 FlashCheaper models, including GPT-4o Mini, Gemini 2.0 Flash, and DeepSeek Chat, are recommended for translating victim messages into Russian, enabling operators to monitor and engage in live interactions with victims acrossGPT-4oThe code authors recommend GPT-4o or Claude Sonnet 4 for responding to victims because these models retain conversational context and are less likely to produce repetitive responses, unlike cheaper models such as Qwen.InstagramThe manuals include guidance for working with Instagram content (both “long term” and “spam”), Threads content, and YouTube shorts.Nano-GPTAffiliates are directed to use Nano-GPT and image-generation models to combine characteristics from photographs of two different individuals or influencers into a new synthetic identity.Polymarketadapted affiliate-fraud models to capitalize on growing public interest in prediction markets such as PolyMarket and Kalshi.PredictONThe service, “PredictON”, provides affiliates with branded websites and domains, configurable markets and odds, traffic and deposit analytics, cryptocurrency payment infrastructure, and a centralized administrativeTelegramAtlasCore’s Telegram posts recorded approximately $10.97 million in claimed deposits across its scam offerings between May 2 and September 18, 2026, with the deposits predominantly associated with prediction markets.TikTokThis channel instructs operators to find attention-grabbing “hook” videos on Instagram or TikTok, particularly clips about AI tools or trading featuring a creator’s face.
Industries
Cryptocurrencysuch teams — AtlasCore, PolyFucked, and Magnetic Team — provide websites, administrative panels, cryptocurrency payment infrastructure, victim-management capabilities, technical support, and promotional guidance.Financial ServicesThe underlying infrastructure is also sufficiently modular to be repurposed for exchanges, casinos, trading applications, and other speculative financial services as the interests of potential targets shift.