1-minute read
What a defender needs to know
Recorded Future’s Insikt Group traced three Russian-language affiliate fraud services, AtlasCore, PolyFucked and Magnetic Team, that supply counterfeit prediction-market websites, payment infrastructure and customer support. Its October 28 research links the operations to more than 100 domains and subdomains. Affiliates drive visitors to sites with familiar event wagers and apparently active trading; operators can control outcomes and block withdrawals.
Insikt Group found AtlasCore settings for per-customer forced wins or losses and withdrawal errors. Magnetic Team’s code chains identity review, account-score and fee demands into a withdrawal funnel; its claimed thousands of traders are simulated activity. AtlasCore’s roughly $10.97 million in posted deposits across its scam offerings, predominantly prediction markets, and PolyFucked’s $2.4 million quarterly turnover come from the operators and are unverified.
For a withdrawal complaint, preserve the landing hostname, referral post, wallet destination, payment receipt and withdrawal messages. Compare those with the research’s domains and site relationships. Insikt Group observed event-x[.]cc connecting by WebSocket to polymarket[.]atlascore-panel[.]net; the same pairing appeared on approximately fifteen more domains. Check your DNS, proxy or referral records for the reported site and linked hosts, then validate current ownership before blocking. Remove impersonating promotions you control and refer exposed payment cards or identity documents to the response teams. Warn the customer about further supposed verification fees.