Search-click task widgets that pay people to fake Google visits to gambling and spam sites

A Vietnamese-language 'get the code' widget embedded on online gambling, football-streaming and pharmacy-spam sites. It stays hidden unless the visitor arrives from a Google search. Such a visitor is asked to wait, scroll the page and pass a check before the widget shows a code to copy, which the visitor then redeems on a paid-traffic platform. People are paid to search for a keyword, click the site in the results and stay on it, so the site collects fake organic search visits. The widget scripts are heavily obfuscated, are served from free hosting such as best-traffic.pages[.]dev, topl.pages[.]dev and mammon-arrived.pages[.]dev, load a copy of an open-source private-browsing detector from andanh.pages[.]dev or anonymous-5cg.pages[.]dev, and fetch their codes from api-client.ontops[.]link, pub.toplinks[.]io or client.gtraffic[.]io. Sites seen carrying it include xoilacchamtv[.]cc, gbctoken[.]co, sunwin28[.]bz, lovecasino[.]co and tg88-nio[.]com. The widget does not take passwords or install software; a match marks a site that buys manipulated search traffic.