Prediction Markets Emerge as a New Vertical for Traffer Teams
Executive Summary
Since the spring of 2026, Insikt Group has observed multiple Russian-language traffer teams that have quickly adapted affiliate-fraud models to capitalize on growing public interest in prediction markets such as PolyMarket and Kalshi. The platforms offered by three such teams — AtlasCore, PolyFucked, and Magnetic Team — provide websites, administrative panels, cryptocurrency payment infrastructure, victim-management capabilities, technical support, and promotional guidance. This model lowers barriers to entry for affiliates and enables campaigns to scale rapidly as new trends attract potential victims. The services combine convincing prediction-market interfaces with established fraud mechanisms designed to manipulate victims and prevent them from recovering deposited funds. These mechanisms include controlled trading outcomes, fabricated market activity, artificial withdrawal restrictions and fees, and the collection of sensitive identity and payment information.
Artificial intelligence (AI) further accelerates this opportunism by reducing the time, cost, and expertise required to adapt campaigns to emerging events. Insikt Group observed threat actors using AI to support multiple stages of their campaigns, including platform development, content creation, social engineering, and victim engagement.
The rapid adoption of prediction markets by multiple traffer teams illustrates a broader threat from mature fraud ecosystems that can pivot toward emerging technologies, financial products, and cultural trends without having to develop entirely new criminal capabilities. Prediction markets are particularly well-suited to this model because legitimate platforms already combine cryptocurrency, speculative financial activity, rapidly changing news events, and social media discussion. Fraud actors can imitate these characteristics to establish credibility and manufacture urgency. As the fraudulent prediction markets gain visibility, additional traffer teams may experiment with the prediction market theme or reuse the underlying tooling for adjacent fraud schemes.
Key Findings
- AtlasCore, PolyFucked, and Magnetic Team supply affiliates with simulated prediction-market websites, administrative panels, payment infrastructure, and promotional support. Advertised compensation includes 70% to 80% of net profits for AtlasCore affiliates, a minimum 60% revenue share for PolyFucked affiliates, and a base 70% share of victim deposits for Magnetic Team affiliates.
- AtlasCore’s Telegram posts recorded approximately $10.97 million in claimed deposits across its scam offerings between May 2 and September 18, 2026, with the deposits predominantly associated with prediction markets. PolyFucked separately advertises approximately $2.4 million in quarterly turnover. Both figures rely on threat actor reporting and remain unverified.
- Magnetic Team advertises more than 3,000 simulated traders across more than 5,000 markets to fabricate convincing trading activity. Its code exposes configurable withdrawal-blocking pretexts, forced-loss controls, and pools of up to 20,000 deposit wallets per blockchain. AtlasCore similarly exposes settings to force wins or losses and impose individualized withdrawal restrictions.
- All three traffer teams advertise or provide AI-assisted victim support. AtlasCore and PolyFucked also supply guidance for AI-generated promotional content, including synthetic influencers and branding, respectively. Magnetic Team’s source code contains indicators of likely AI-assisted development, suggesting AI use may extend to building and maintaining the underlying fraud platforms, although that assessment remains unconfirmed.
- Insikt Group identified over 100 unique domains and subdomains associated with AtlasCore, PolyFucked, and Magnetic Team, including administrative infrastructure and scam websites likely operated by the teams or their affiliates.
Threat Analysis
AtlasCore
In August 2026, Insikt Group identified a post on a low-tier cybercriminal forum seeking affiliates to join the traffer team “AtlasCore”. The thread was first created on May 15, 2026, by the user “AtlasCore”. The affiliate program was also advertised on a top-tier cybercriminal forum by the user “AtlasCorp” on May 28, 2026. The program includes an offering for prediction markets, as well as more typical traffer scams such as cryptocurrency exchanges and casinos.
The prediction market program is modeled on platforms such as Polymarket, with event-based YES/NO wagering, displayed probabilities, trading volumes, liquidity data, and live market activity. Promotional material shows markets covering politics, cryptocurrency prices and events, and sports. Affiliates can reportedly create their own events and scenarios, and tailor markets by geography and traffic source.
Based on the listing, AtlasCore provides the underlying platform, infrastructure, automation, and support for affiliates to use to launch their campaigns. The program advertises a profit-sharing model in which affiliates receive 70% of net profits at launch, with the affiliate share reportedly increasing to as much as 80% based on turnover. The program also offers a referral structure in which partners receive 10% of the profit generated by affiliates they recruit. The operator claims that there are no subscription or licensing fees and advertises cryptocurrency payout times (to partners) of approximately 30 minutes.
Telegram and Manuals
AtlasCore operates several Telegram channels, listed below:
- “ATLASCORE | CHAT”: Created on June 2, 2026, with 860 members as of this writing. This channel serves as a general-purpose chat where members advise one another on traffic generation and domain management techniques.
- “ATLASCORE | NEWS”: Created on May 1, 2026, with 480 members as of this writing. This channel is used by AtlasCore administrators to publish updates about the platform and the affiliate program.
Interested users are directed to apply to the team using the Telegram bot @AtlasCoreTeam_bot. There are also separate Telegram bots used to apply to and operate the prediction market offering (@AtlasCorePolymarket_bot) as well as the Casino offering (@AtlasCoreCasino_bot). For points of contact, users are directed to message @AtlasCoreManage for technical support or @ajento for general questions.
Once they join the cryptocurrency exchanges team, which is the default offering at this time, affiliates gain access to the panel hosted at atlascore-panel[.]net; the sub-teams are hosted at polymarket[.]atlascore-panel[.]net and casino[.]atlascore-panel[.]net, and require separate applications and credentials for joining. The team also hosts several manuals at the docs[.]atlascore-panel[.]net subdomain. The manuals include guidance for working with Instagram content (both “long term” and “spam”), Threads content, and YouTube shorts. For long-term work, the manuals recommend that affiliates use a mobile proxy purchased through the services luxproxy[.]cc, proxy-store[.]cc, or proxy-seller[.]com.
The manuals also provide affiliates with instructions for creating and operating AI-generated social media personas to promote its prediction market and exchange offerings. Affiliates are directed to use Nano-GPT and image-generation models to combine characteristics from photographs of two different individuals or influencers into a new synthetic identity. This image then serves as a persistent reference for generating realistic photographs and short videos, enabling affiliates to maintain a fictional influencer persona without relying on a real individual for content production.
For the prediction market offering, the manuals recommend selecting trending events from the platform, particularly current news and geopolitical developments, and producing short reaction videos around them. Affiliates are instructed to record the prediction-market page, including their domain, selected outcome, wager, and potential profit, and combine this footage with an AI-generated video of the synthetic influencer reacting to or commenting on the event. The manuals describe this approach as a way to attract organic traffic by capitalizing on trending topics and recommend publishing the resulting content as Instagram Reels with event-specific hashtags.
The manuals explicitly instruct affiliates to conceal indicators that the influencer content was generated using AI. Affiliates are told to remove metadata from generated images and videos before uploading them to Instagram to reduce the likelihood that the platform labels the content as AI-generated. The guides also recommend using realistic synthetic voices and aspirational lifestyle imagery, including photographs depicting the persona with luxury vehicles, to increase viewers' trust in the account, the advertised product, and the constructed personal brand. The manuals refer to prospective users as “мамонты” (“mammoths”), slang commonly used in Russian-language fraud communities to describe victims or targets.
Infrastructure
Within the prediction market offering, affiliates can register their own domains or use shared domains created by AtlasCore. As of this writing, Insikt Group observed the following shared domains used by the team, with data obtained via DomainTools and the Recorded Future platform:
- prdct[.]cc: This domain was most recently registered on August 10, 2026, and its IP address is currently hidden behind Cloudflare.
- event-x[.]cc: This domain was most recently registered on July 14, 2026, and became inactive as of August 20, 2026. While active, the website’s IP address was hidden behind Cloudflare. Insikt Group identified a post on Reddit in which a user described accounts marketing this domain, along with offers of $1,000 for joining.
- predicate[.]cc: This domain was most recently registered on May 21, 2026, and became inactive as of August 20, 2026. While active, the website’s IP address was hidden behind Cloudflare. Insikt Group also identified three additional domains that share the same website title: predictedby[.]cc (first seen August 15, 2026), predicate[.]world (first seen July 31, 2026), and predicate[.]live (first seen July 22, 2026).
- predicate[.]club: This domain was most recently registered on August 12, 2026. Between its registration date and August 14, 2026, the domain was hosted at the IP address 192[.]162[.]199[.]243; after that, the domain moved behind Cloudflare. Other domains hosted on the same IP address include speculor[.]net, rqwrujarser[.]icu, wettora[.]com, bravioar[.]com, and winzo[.]live; these domains hosted casino-, exchange-, and prediction-market-related content, suggesting a possible connection to AtlasCore. Insikt Group further pivoted via one of the JavaScript files used by the predicate[.]club page to identify an additional ten domains hosting similar content.
- predictum[.]app: This domain was most recently registered on August 12, 2026. Insikt Group also identified two additional domains that share the same website title: predictum[.]pro and predictum[.]cc.
The panel also contains several example webpages, hosted at testdomainatlas[.]com. According to open sources, this web page is associated with the email address austinhenderson199962[@]quickblox[.]net. As of August 8, 2026, this page displayed an error message: “Page not found - Altascore.” Pivoting from this value, Insikt Group identified fifteen additional web pages displaying the same error message.
Using open-source tooling, Insikt Group observed that event-x[.]cc established a WebSocket connection to polymarket[.]atlascore-panel[.]net. Using this finding, we pivoted to identify approximately fifteen additional domains exhibiting this behavior, likely indicating they were used in AtlasCore’s prediction market scam operations.
Insikt Group also identified several JavaScript files used by predicate[.]cc, such as “/build/assets/app-Ch74MqWt.js” and “/build/assets/app-DwKjOmEK.js”, likely unique per individual affiliates. Based on an initial analysis of the code, this file likely provides the primary victim-facing functionality of the fake prediction market and exposes the administrative panel's functionality. The code internally labels users as “mamont” (the Russian word for “mammoth”). The platform enables operators to manipulate fast Up/Down markets globally or per victim, explicitly stating that a win-chance value of 0 means “always lose” and 100 means “always win”. The code also includes settings to import data from the public Polymarket API, likely enabling the scam to mimic legitimate market activity.
The code also supports several mechanisms to extract additional funds and prevent victims from withdrawing. It provides configurable withdrawal-error templates, including victim-specific customizations, and exposes dedicated components: WithdrawErrorModal, WithdrawModal, and MamontWithdrawErrorBlock. The panel also lets operators define deposit, trade, and withdrawal fees, minimum deposits, artificial starting balances, and individualized financial terms.
The victim interface is also designed to collect highly sensitive financial and identity information. It contains fields for a card number, cardholder name, expiration date, and CVV, as well as a purported “know-your-customer” (KYC) process that requests personal details, images of identity documents, and a selfie with each document. The code supports passports, identity cards, and driver’s licenses, with uploads of both sides of each document.
The analyzed code also exposes the platform’s recommendations for operators’ integration of AI to assist with social engineering via the customer support feature. The guidance indicates that the scammers acquire a key from NanoGPT and use the model to generate and automatically send support responses under an operator persona. The code authors recommend GPT-4o or Claude Sonnet 4 for responding to victims because these models retain conversational context and are less likely to produce repetitive responses, unlike cheaper models such as Qwen. Cheaper models, including GPT-4o Mini, Gemini 2.0 Flash, and DeepSeek Chat, are recommended for translating victim messages into Russian, enabling operators to monitor and engage in live interactions with victims across a language barrier. Operators can control response language, tone, restrictions, and length through system instructions, token limits, and prompt templates containing the full conversation and client data. The platform also supports designating a secondary model from another provider when the primary model refuses a request. The guidance states that retrying the same model is ineffective because the refusal will be consistent across multiple attempts. Automatic Russian translation is limited to new conversations and becomes active only after a victim’s first deposit. The API key is stored server-side and is not returned to the browser after configuration.
In addition to the application JavaScript file, Insikt Group identified several other JavaScript files that included variables referencing the term “mamont”. Pivoting from one such file hash, we identified several additional domains that used this file. Full lists of domains and IP addresses associated with AtlasCore, as identified by Insikt Group, are available in Appendices A and B.
Profits
In addition to AtlasCoreNews and chat Telegram channels, AtlasCore also operates a channel broadcasting deposits by victims on threat-actor-controlled prediction market pages; the channel is called “Депозиты” (“Deposits”, t[.]me/+N_juj1e38-U1Mzlh), was created on May 2, 2026, and has 613 subscribers as of this writing. The channel displays transactions across a variety of cryptocurrencies (with the majority in Bitcoin [BTC]) and also provides information on the type of scam that generated the profit (prediction market, exchange, or casino).
Insikt Group analyzed the total profits generated by affiliates since the channel’s inception, totaling approximately $10,971,989.72 as of September 18, 2026. The majority of posted deposits were made in BTC via the prediction market scam. Note that this data is entirely reliant on self-reporting via the AtlasCore platform; as such, the figures may be exaggerated.
Although some affiliate names (approximately 10%) are hidden in the channel messages, Insikt Group was able to identify the top-named earners in AtlasCore based on the number of transactions posted to the channel and the highest revenue per individual.
PolyFucked
Insikt Group identified an advertisement for the prediction-market-themed offer “PolyFucked”, posted to a low-tier cybercriminal forum on May 26, 2026, by the user “after_day”. after_day has previously been tracked by Insikt Group for operating After Change, an over-the-counter (OTC) exchange and mixing service, and in 2025 was observed posting forum advertisements on multiple cybercriminal forums for After Drainer, a cryptocurrency drainer-based traffer offer.
The program is marketed as a ready-to-deploy product that requires affiliates to provide a domain and traffic, while it supplies the prediction-market infrastructure, administrative panel, automated payments, and technical support. The program describes prediction markets as a particularly high-converting offer and claims that its product requires no development by affiliates.
PolyFucked advertises a prediction-market interface designed to resemble established platforms, featuring YES/NO outcomes, price or probability charts, order-book functionality, comments, positions, and activity information. The platform also advertises support for more than 180 geographies. The affiliate receives access to a centralized administrative panel that contains statistics on domains, registrations, deposits, and payouts. Advertised capabilities include real-time statistics, promotional codes, and user retention functionality, Telegram bot notifications, and AI-powered support. PolyFucked also claims that smart contracts enable 24/7 automated payouts, reducing the need for affiliates to manually process withdrawals.
PolyFucked advertises a minimum 60% revenue share and claims approximately $2.4 million in quarterly turnover, although these figures could not be independently verified from the provided material. The program also states that it provides affiliates with training in current promotional methods and ongoing 24/7 support.
Telegram and Manuals
The threat group operates several Telegram channels, listed below:
- “PolyFucked | CHAT”: Created August 26, 2026, with 459 members as of this writing. This is a general-purpose chat channel for affiliates to discuss their campaigns and strategies.
- “polyfucked affiliate”: Created August 11, 2026, with 223 members as of this writing. This is a more exclusive channel for active affiliates.
Key members of the Telegram groups are @polyfuckr (listed as “dev”), @kasrador (listed as “tech support”), and @polyfuckers (listed as “owner”). The Telegram bot used by the group for user intake and resource sharing is @PolyFuckedBot. The bot also includes capabilities to search for available domain names for affiliates to host their scam sites.
Within the Telegram group “polyfucked affiliate”, there are several sub-channels. These include general-purpose chat and informational channels, as well as dedicated channels for manuals and guides for running operations. These include:
- Instagram traffic (“залив instagram”): The channel provides instructions for spreading prediction-market scam content specifically through Instagram. It recommends using a dedicated SIM-free phone configured for the US, disabling location and tracking, and keeping a VPN active. Suggested services include ExpressVPN or Surfshark; 2ip[.]ru for checking IP location; Google or iCloud+ email accounts; and 5sim[.]net, SMS-Activate, or @SMSGruBot for phone verification. Operators are told to keep these accounts separate from personal profiles and scale gradually to four Instagram accounts per device. PolyFucked’s Instagram distribution strategy involves warming up new accounts through limited engagement with Polymarket-related Reels, disguising them as ordinary creator profiles, and avoiding explicit gambling language.
- Logo creation (“создание лого”): This channel explains how operators can quickly create branding for scam domains using AI image-generation services such as Gemini, Nano Banana via Google Flow, or ChatGPT. It provides reference logos from betting brands such as Rainbet, 1win, and Stake, along with reusable prompts instructing the model to modify the logos to output a high-quality logo per the user’s specification on a transparent background in a square 1:1 format.
- Creative examples (“примеры креативов”): This channel instructs operators to find attention-grabbing “hook” videos on Instagram or TikTok, particularly clips about AI tools or trading featuring a creator’s face. It recommends downloading them without watermarks using Telegram bots such as @SaveAsBot or @foreelbot, then using CapCut to isolate and crop the hook for reuse in promotional scam videos.
Infrastructure
Upon being accepted to PolyFucked, a member receives access to the admin panel, which is accessible via both Telegram and web browser. As of this writing, it is hosted at polyfucker[.]space, which was registered on June 17, 2026, and is hidden behind Cloudflare as of this writing.
Within the PolyFucked offer, affiliates can register their own domains or use shared domains created by PolyFucked. As of this writing, Insikt Group observed the following shared domains used by the team:
- preds[.]co: According to the panel and open sources, this domain was registered on August 24, 2026. As of this writing, its IP address is hidden behind Cloudflare.
- resolve[.]bet: According to the panel, this domain was added on August 27, 2026. As of this writing, its IP address is hidden behind Cloudflare.
Inspection of the source code of these websites showed references to an additional domain, forutsagt[.]bet, registered on April 5, 2026, to the IP address 81[.]90[.]17[.]100. According to DNS records, the email address maedawyggertie[@]gmx[.]com is associated with the domain. Recorded Future data also linked the domains to kiro-cheap[.]pro, futaryx[.]com, fortvet[.]cc, and fortexp[.]live, where forutsagt[.]bet was listed as the canonical URL for all. The domain kiro-cheap[.]pro was further linked to the email address bvzfsderman[@]gmx[.]com, and was hosted at the IP address 83[.]217[.]208[.]78, before moving to 81[.]90[.]17[.]100, then moving behind Cloudflare.
Insikt Group also identified the ETH address 0x2d71435b9bd26cb60fa874ce88d6b856f9a166d0 (View Transaction History) listed as a “Profile Wallet” in the verification section, which falsely claims that preds[.]co is an official PolyMarket mirror. This address has no activity as of this writing.
Pivoting further on the logo favicon used by forutsagt[.]bet, pred[.]co, and resolve[.]bet, Insikt Group identified an additional twelve domains using the same logo. We assess that these are likely domains operated by PolyFucked affiliates. Full lists of domains and IP addresses associated with PolyFucked, as identified by Insikt Group, are available in Appendices A and B.
Magnetic Team
Insikt Group identified another prediction market-themed traffer team advertisement posted to a low-tier cybercrime forum on July 17, 2026, by the user “MagneticCEO” on behalf of Magnetic Team. The service, “PredictON”, provides affiliates with branded websites and domains, configurable markets and odds, traffic and deposit analytics, cryptocurrency payment infrastructure, and a centralized administrative panel. Magnetic Team advertises a base payout of 70% of player deposits, with potentially higher rates as deposit volume increases, and states that affiliates are primarily responsible for directing traffic while attribution, deposit processing, and payouts are automated.
Magnetic Team claims to operate more than 3,000 bots across more than 5,000 markets using bots that emulate a variety of trading behaviors, such as high-frequency trading (HFT), arbitrage, swing, whale, and casual trading profiles; it explicitly states that these bots belong to a “fake-user pool” and behave differently to make order-book activity appear natural. The platform also advertises an order-book simulator, automated discussion generation, and eight comment personas, enabling operators to simulate both trading and social activity. Affiliates can additionally configure prediction-market odds and deploy white-label websites with their own branding, domains, bonuses, promotional codes, AI-assisted chat, and geographic targeting.
Magnetic Team advertises automated payment processing across eight blockchain networks and integrations with seven fiat-to-cryptocurrency payment providers, including Transak, Ramp, Link by Stripe, Mercuryo, MoonPay, Banxa, and Revolut. According to its promotional material, users are permanently attributed to the affiliate who acquired them, deposits are automatically credited, and the affiliate's share can be settled in Tether (USDT), BTC, or Monero (XMR).
Infrastructure
Interested users are directed to apply to Magnetic Team via its Telegram bot, @magneticteam_bot. Once a user is accepted to the team, they can use the bot to view their profile and partner token, view statistics for their campaigns, manage their domains, refer new traffers, and contact Magnetic Team support.
The team also operates several Telegram channels, including the following:
- “MAGNETIC CHAT”: Created on August 16, 2026, with 31 members as of this writing. This channel serves as a general-purpose chat where members advise one another on traffic generation and domain management techniques.
- “Magnetic | updates”: Created on July 15, 2026, with 40 subscribers as of this writing. This channel is used by Magnetic Team administrators to announce platform updates.
- “Magnetic | TRAFFIC”: Created on July 18, 2026, with 21 subscribers as of this writing. This channel has primarily been used by administrators to repost updates from the “Magnetic | updates” channel.
The owner and administrator of these channels is @MagneticCEO.
Infrastructure
Participants in Magnetic Team are directed to manage their campaigns via an administrative panel hosted at magnetic-panel[.]space. This domain was registered on July 13, 2026, to the IP address 31[.]76[.]10[.]48. As of this writing, this IP address also hosts the domains tradingai[.]fun, crossbook[.]xyz, and btwoteam[.]xyz; of these, only btwoteam[.]xyz resolves. Insikt Group also previously observed the domain polymarket[.]casino hosted on the same IP address prior to moving behind Cloudflare; as of this writing, this domain is actively impersonating Polymarket.
Magnetic Team also operates an “example” PredictON website that they share with affiliates, predicton[.]org. This domain was most recently registered on May 6, 2026. Prior to being moved behind Cloudflare on July 7, 2026, the domain was parked on the IP addresses 192[.]64[.]119[.]163 and 91[.]195[.]240[.]19; afterwards it was moved to 87[.]120[.]165[.]193, 31[.]77[.]159[.]194, and 31[.]76[.]10[.]48. Notably, 31[.]76[.]10[.]48 is the IP address currently used by magnetic-panel[.]space. As of this writing, both btwoteam[.]xyz and predicton[.]org are hosting identical content. Full lists of domains and IP addresses associated with Magnetic Team, as identified by Insikt Group, are available in Appendices A and B.
Historical open-source data indicates that btwoteam[.]xyz was previously the login panel for “TraffHub”, likely another traffer project. The document object model (DOM) of the web page also contains references to predicton[.]org, suggesting that this project was likely operated by the same individuals as Magnetic Team.
Insikt Group identified over 1,000 references within the Recorded Future platform to “TraffHub”, primarily on traffer-related Telegram channels. TraffHub likely refers to the “iGaming” traffer employment arbitration platform, TraffHUB. Outside of the shared infrastructure, Insikt Group cannot conclusively determine the connection between TraffHUB and Magnetic Team.
Based on further analysis of web page source for magnetic-panel[.]space, Insikt Group identified several JavaScript files containing operational logic for the administrative panel. These files include partner.js, partner-rigging.js, partner-extras.js, partner-push.js, partner-wallets.js, and partner-seo.js. Based on these files, the panel's core scam mechanism is a configurable "withdrawal funnel" that chains fabricated refusal pretexts (identity verification, AML review, VIP-tier upgrade fees, an "Account Protection Score," and withdrawal taxes) to block victim payouts indefinitely, paired with a "Boost" module that lets operators set a per-player target win rate, a balance cap that suppresses payouts once a victim's balance grows, and a forced-loss cooldown after consecutive wins. Victim funds are captured through a bulk-generated pool of up to 20,000 deposit wallets per chain (Ethereum Virtual Machine [EVM], Solana [SOL], BTC, Toncoin [TON], Tron), with private keys exposed and CSV-exportable the moment a wallet receives a deposit, enabling direct fund sweeping. Social-engineering support is built in via six interchangeable fake "support persona" identities and delegable chat-access keys, while a "trade-sim" feature fabricates trading activity to make victim accounts appear active.
Insikt Group also assesses that the files were likely generated as part of an iterative, AI-assisted development process, rather than solely by human developers. The code is heavily commented in English with justifications for design choices and explanations of bug fixes. The HTML homepage includes two comments that embed verbatim Russian-language operator complaints — "почему в настройках все прибито к левому краю?" ("why is everything in Settings glued to the left edge?") and "в чате не видно кто онлайн какие трафферы есть" ("in the chat you can't see who's online, which traffers there are") — quoted as the literal justification for specific user interface (UI) fixes (centering the Team Settings column; adding a roster sidebar to Team Chat). This pattern provides evidence of an iterative development process in which Russian-language operator feedback was incorporated into subsequent code changes.
File-level header comments also read as an agent justifying its own scoping decisions. We did not identify any explicit AI attribution string in the code, so note that this assessment is a style-based inference rather than a confirmed signature; however, the consistency and self-narrating nature of the commentary across all modules is most consistent with a large language model (LLM) coding assistant iteratively building and patching the panel over many small, bug-driven sessions.
We also identified several references within the panel web page's HTML to a file, “TEAM_V2_DESIGN.md”, in which specific sections of that file are cited as the source and rationale for specific design choices within the panel. Although this file was not present in the publicly accessible web hosting infrastructure, Insikt Group assesses that it is likely an internal specification document that may have informed the actions of the LLM agent that the threat actors used to help code the platform.
Outlook
The emergence of multiple prediction-market traffer programs indicates that this theme will likely become another reusable vertical within the broader affiliate-fraud ecosystem. As legitimate prediction markets attract attention around elections, geopolitical crises, cryptocurrency movements, and major sporting or cultural events, traffer teams will likely launch campaigns increasingly quickly around such high-interest developments. The underlying infrastructure is also sufficiently modular to be repurposed for exchanges, casinos, trading applications, and other speculative financial services as the interests of potential targets shift.
AI will likely further reduce the time, expertise, and resources required to launch and operate these campaigns. Its observed use for synthetic influencers, promotional material, multilingual victim support, and potentially software development suggests that increasingly sophisticated operations will become accessible to less technically capable affiliates. AI-assisted development and content generation will likely accelerate platform cloning and localization, while automated victim engagement will allow operators to target more geographies and maintain larger numbers of simultaneous interactions.
These developments point toward a broader shift to highly scalable, event-driven fraud-as-a-service in which reusable technical infrastructure is combined with AI-generated content and rapidly changing social media trends. Individual scam domains and brands will likely become increasingly transient, while the underlying platforms, affiliate communities, payment infrastructure, and tooling persist across successive campaigns. Tracking shared code, infrastructure, cryptocurrency flows, and operator relationships will therefore become increasingly important for identifying continuity between ostensibly separate fraud operations.
Appendix A: Domains
AtlasCore Domains:
atlascore-panel[.]net
polymarket[.]atlascore-panel[.]net
casino[.]atlascore-panel[.]net
docs[.]atlascore-panel[.]net
prdct[.]cc
event-x[.]cc
predicate[.]cc
predictedby[.]cc
predicate[.]world
predicate[.]live
predicate[.]club
speculor[.]net
rqwrujarser[.]icu
wettora[.]com
bravioar[.]com
winzo[.]live
predictum[.]app
predictum[.]pro
predictum[.]cc
egov-x[.]com
deltevent[.]cc
delevent[.]cc
uppulse[.]xyz
depredictor[.]com
plexocade[.]com
predictmex[.]com
gobeast[.]bet
testdomainatlas[.]com
vnite[.]pro
depredictor[.]com
polycore[.]club
winzo[.]cc
polyweb[.]cc
holymarket[.]guru
polyblink[.]com
vuefax[.]com
polywax[.]net
zevrix[.]pro
polym[.]cc
deltapredict[.]net
polyxmarket[.]com
polyxchange[.]net
polymusk[.]net
polymrkt[.]cc
polymeet[.]cc
x-predict[.]cc
futurecastx[.]com
Polymarts[.]net
event-pick[.]com
predict[.]biz
polidex[.]cc
polymarket-labs[.]click
polyspace[.]cc
4pred[.]cc
werexo[.]com
plmrkt[.]com
polix[.]cc
7poly[.]icu
lootwox[.]com
polycore[.]cc
zarama[.]xyz
govazex[.]com
trybet[.]cc
polora[.]top
premrkt[.]cc
prognozland[.]com
polytax[.]cc
polylook[.]cc
prdect[.]lat
polymak[.]cc
polydep[.]com
swapnux[.]com
eventmex[.]com
tonchange[.]cc
apexswap[.]top
gemchange[.]com
predictionmarket[.]help
exchangezone[.]xyz
valorewards[.]shop
huesos[.]shop
jetox[.]top
fnbox[.]top
PolyFucked Domains:
polyfucker[.]space
preds[.]co
resolve[.]bet
forutsagt[.]bet
kiro-cheap[.]pro
futaryx[.]com
fortvet[.]cc
fortexp[.]live
authmy[.]co
predxmarket[.]xyz
polyfucked[.]top
fortnitebeast[.]top
predictbase[.]site
predivo[.]trade
polydexy[.]com
pollymarket[.]world
polyrnarket[.]vip
oraculus[.]live
oraculus[.]bet
forelytic[.]com
poly-market[.]top
Magnetic Team Domains:
magnetic-panel[.]space
tradingai[.]fun
crossbook[.]xyz
btwoteam[.]xyz
predicton[.]org
polymarket[.]casino
Appendix B: IP Addresses
AtlasCore IPs:
192[.]162[.]199[.]243
158[.]94[.]209[.]19
PolyFucked IPs:
81[.]90[.]17[.]100
83[.]217[.]208[.]78
89[.]213[.]118[.]50
Magnetic Team IPs:
31[.]76[.]10[.]48
192[.]64[.]119[.]163
91[.]195[.]240[.]19
87[.]120[.]165[.]193
31[.]77[.]159[.]194
31[.]76[.]10[.]48
Related Resources
Explore expert insights, reports, and tools to strengthen your cybersecurity strategy.