---
id: "CMP-202611-wo3xz2"
kind: "campaign"
aliases: []
title: "Fake Polymarket and Kalshi prediction-market sites, promoted by AI-made influencers on Instagram, take crypto deposits and ID documents and never let victims withdraw (Recorded Future)"
severity: "medium"
cvss: null
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "Polymarket", "fixed": [], "vendor": "Polymarket"}, {"name": "Kalshi", "fixed": [], "vendor": "Kalshi"}, {"name": "Instagram", "fixed": [], "vendor": "Meta"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-03T22:18:56+00:00"
updated_at: "2026-11-03T22:20:15+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-03T22:18:56+00:00"}]
---

# Fake Polymarket and Kalshi prediction-market sites, promoted by AI-made influencers on Instagram, take crypto deposits and ID documents and never let victims withdraw (Recorded Future)

Since spring 2026, Russian-language scam crews AtlasCore, PolyFucked and Magnetic Team have rented out ready-made fake prediction-market sites that look like Polymarket or Kalshi, with YES/NO bets on news, politics, crypto and sports. Affiliates promote them with AI-generated fake influencers posting Instagram Reels, Threads and YouTube Shorts about trending news, sometimes offering a sign-up bonus (one Reddit report: $1,000 for joining). The sites show fake trading activity, let the operator force a victim to lose, block withdrawals with fake errors and fees, ask for card number and CVV, and run a fake 'KYC' asking for photos of passports, ID cards or driver's licences and selfies. Support chat is answered by AI. AtlasCore claims about $10.97M in deposits from May to Sep 2026 (unverified). Recorded Future found 100+ domains; the full list is in its report appendices.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Polymarket affected ? fixed ?
- :Kalshi affected ? fixed ?
- :Instagram affected ? fixed ?

## How to check

Match links and sites against the domains Recorded Future names: prdct[.]cc, event-x[.]cc, predicate[.]cc, predictedby[.]cc, predicate[.]world, predicate[.]live, predicate[.]club, predictum[.]app, predictum[.]pro, predictum[.]cc, speculor[.]net, wettora[.]com, bravioar[.]com, winzo[.]live, preds[.]co, resolve[.]bet, forutsagt[.]bet, futaryx[.]com, fortvet[.]cc, fortexp[.]live, kiro-cheap[.]pro; panels atlascore-panel[.]net and polyfucker[.]space; IPs 192[.]162[.]199[.]243, 81[.]90[.]17[.]100, 83[.]217[.]208[.]78. preds[.]co falsely claims to be an official PolyMarket mirror. The real sites are polymarket.com and kalshi.com. Warning signs: a prediction market found through an Instagram/TikTok influencer reel, a joining bonus, a 'withdrawal error' or fee before you can withdraw, or a request for ID photos plus a selfie.

## Fix

Do not deposit on any prediction-market site reached from a social-media post; type polymarket.com or kalshi.com yourself. If you already deposited, do not pay any 'withdrawal fee' or 'verification fee' (the money will not come back), keep the transaction IDs and report to your local fraud authority. If you sent card details, call your bank to block the card; if you uploaded ID photos, watch for identity fraud. Organisations can block the listed domains.

## Timeline

- 2026-11-03T22:18:56+00:00 analyst

## Documents

- [describes] KnowBe4: Warning: Phishing Operations Are Impersonating Prediction Markets https://blog.knowbe4.com/warning-phishing-operations-are-impersonating-prediction-markets
- [describes] Prediction Markets Emerge as a New Vertical for Traffer Teams (Recorded Future Insikt Group) https://www.recordedfuture.com/research/prediction-markets-traffer-teams

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_