A prediction-market site can show live prices, busy trading and a customer balance while its operator decides whether the customer wins or gets paid. Recorded Future’s Insikt Group traced that setup across three Russian-language affiliate fraud services: AtlasCore, PolyFucked and Magnetic Team. Its October 28 research connects the services to more than 100 domains and subdomains, including fake betting sites and admin infrastructure.
These are services for affiliates who bring visitors to a counterfeit market, often through social media, while the service supplies the website, payment plumbing and support. A visitor may see a familiar yes-or-no wager on a news event. The stakes for a fraud or platform-abuse team begin when that visitor deposits money or sends card details and identity documents to a site controlled by the scammers.
Operators control the displayed market
Insikt Group examined AtlasCore’s site code and found controls for forcing a fast-market win or loss globally or for an individual customer. It also found settings for fake balances, deposit and trading fees, and withdrawal errors tailored to a particular person. The customer-facing form requests a card number, expiration date and CVV, plus identity documents and selfies under a purported know-your-customer process. A price chart and an account balance can therefore be part of the lure rather than evidence that the visitor has a usable account.
Magnetic Team advertises a “fake-user pool” of more than 3,000 simulated traders across more than 5,000 markets. Magnetic Team calls them bots; the advertised counts describe simulated activity. In code Insikt Group inspected, the team’s PredictON service provides a withdrawal funnel that can demand identity review, an anti-money-laundering check, a VIP upgrade fee, an account score or a withdrawal tax. Its controls can also set an individual win rate and cap a balance. Once a deposit reaches one of its generated cryptocurrency wallets, the panel exposes the wallet’s private key for sweeping the funds.
PolyFucked offers affiliates a ready-made market and admin panel, and advertises a minimum 60% revenue share. AtlasCore offers 70% of net profit at launch, rising to as much as 80% based on turnover; Magnetic Team advertises a base 70% share of deposits. These are the teams’ advertised terms. Insikt Group calculated about $10.97 million in deposits posted to AtlasCore’s Telegram channel from May 2 to September 18 across its scam offerings, predominantly prediction markets. That figure comes from the operators’ own posts and is unverified. PolyFucked’s claimed $2.4 million quarterly turnover is also unverified.
Social accounts feed the sites
AtlasCore’s manuals describe synthetic influencer accounts that promote trending wagers through short videos. They tell affiliates to remove AI-content metadata before posting. PolyFucked provides branding and social promotion guidance. The platform’s promise of an easy wager arrives through a social account that may look like an ordinary creator.
Insikt Group also found AI-assisted customer support in the services. AtlasCore’s code describes automated responses to customers and Russian translation of new conversations after a first deposit. For Magnetic Team, the researchers judged AI-assisted software development likely from code comments and references to an internal design document. The promotional and support uses are observed or advertised features; the coding assessment is an inference.
The infrastructure offers a firmer pivot than the theme of a social post. Insikt Group observed event-x[.]cc opening a WebSocket connection to polymarket[.]atlascore-panel[.]net, then found approximately fifteen more domains with that behavior. It also linked PolyFucked sites through source-code and favicon relationships, and mapped Magnetic Team’s example site predicton[.]org to its panel infrastructure. Those relationships help connect an affiliate’s changing public domain to the service behind it; validate current ownership and activity before blocking or reporting a related host.
Trace a complaint to the affiliate
If someone reports a prediction-market withdrawal fee, preserve the landing URL, referral post, deposit address, payment receipt and screenshots of the withdrawal demand. Compare the host with the defanged domains and infrastructure relationships in Insikt Group’s appendices. For a platform abuse desk, search its own referral, click and DNS or proxy records for the site and the linked admin hosts; prioritize the observed WebSocket pairing when connection telemetry is available. These are leads to investigate, because affiliates can use their own domains.
Remove confirmed impersonating promotions or listings on services you operate, and escalate payment or identity-document collection to the teams that can intervene. Where a customer has sent a card number or document images, route the case to the payment and identity-response process as well as the fraud queue. Explain the withdrawal pattern to affected users before another supposed verification fee is paid.
Verify the site behind the wager
Start with the complaint’s exact hostname and wallet destination. Compare the hostname and any linked admin host with the relationships Insikt Group documented, then check your DNS or proxy records for connections to those hosts. Preserve the referral post, deposit address, payment receipt and withdrawal messages together so the abuse and payment responders can trace the affiliate. Remove confirmed impersonating promotions on services you control, and route exposed payment cards or identity documents to the response team. The expected result is an attributable site and a preserved payment trail. The displayed odds and trader activity are under the operator’s control.