Google's Poisoned SERPs: 8% of Tracked Rank Data Was Fake

Introduction

On September 29, 2026, the rank-tracking company Nozzle fetched Google's first page for a large sample of keywords and got back results pages that looked completely ordinary: same layout, ten blue links, no CAPTCHA, no error message. The only thing wrong was the rankings. Roughly 27% of the pages collected that day had their organic results quietly swapped out for different sites, according to Nozzle's study Poisoned Google SERPs, published October 10 and reported by Search Engine Roundtable's Barry Schwartz on October 12.

Site owners watching their dashboards that morning saw their most important pages fall out of the top 10. Two days later the rankings were back. Nothing about their sites had changed in between.

This is a different kind of problem from every previous fight between Google and the SEO tool industry. Blocked requests leave an empty cell you can see. A poisoned page leaves a confident number that gets written into a client report, a content plan, or a decision to rewrite a page that was never actually losing. If your keyword strategy depends on rank data, you need to know how this happened, how big it is, and what to change.

What Nozzle Found

Nozzle's dataset is the most detailed public measurement of the problem so far. The company collected 27.5 million SERPs between September 13 and October 9, 2026, of which 17.8 million had enough history to be judged, across 49 countries and three device types (desktop, iPhone, Android). Counting from August 20, the full sample ran to 63.1 million pages.

The headline number: 8.0% of collected pages were "poisoned," against 0.17% before the change. That is a roughly 47-fold increase in the share of unreliable data flowing into rank tracking pipelines.

The timeline is precise, and it matters because it overlaps a confirmed Google update:

September 13: requests to Google start failing in large volumes (blocking).
September 20: the first poisoned pages appear among requests that still got through.
September 27–29: poisoning peaks at 24.9%, 26.7% and 27.0% of pages.
October 1 onward: the rate settles at roughly 5% to 11% per day.

Nozzle's definition is deliberately conservative. A keyword's "usual" sites are those that held a top-10 position on at least 60% of its pages between August 20 and September 9. A page counts as poisoned only when fewer than half of those usual sites appear anywhere on it, and when they return on a later collection. By that measure, only 20.7% of organic sites carried over from the previous collection on poisoned pages, against 88.5% at baseline.

The replacements were not random. Nozzle recorded the largest gains for social platforms and forums:

Reddit: 20.8% of top-10 appearances elsewhere → 28.8% on poisoned pages (+8.0 percentage points, the biggest shift in the study)
Facebook: 28.3% → 33.8%
Instagram: 9.6% → 12.1%
LinkedIn: 6.2% → 9.3%
Quora: 5.3% → 6.7%
YouTube, Yelp and MapQuest lost share

For anyone paying for rank tracking, one figure stands above the rest: a project's own tracked site was missing from the top 10 on 58.6% of poisoned pages, compared with 2.7% at baseline. If a site "disappeared for a day" in late September and then came back, this is the most likely explanation.

Two smaller details are worth filing away. First, paid listings behaved differently — ads were carried over 83.7% of the time on poisoned pages versus 70.6% at baseline, meaning organic results were swapped far more aggressively than paid ones. Second, the incidents were short: 80% of poisoned spells lasted a single collection, and on 77.9% of affected pages the usual sites returned within three days (median: two).

According to Derek Perkins of Nozzle, quoted in the Search Engine Roundtable report, Google is running a three-pronged campaign: very wide IP blocking that targets major residential proxy networks, CAPTCHAs at a significantly increased rate, and bad data injection — placing wrong results into pages served to suspect clients "so that when the tools do scrape the results, they get the wrong data in some cases."

The Vendor Split: 27% or 1.4%?

If you ask two vendors the same question about the same day, you get two different worlds. On September 29, Nozzle measured 27% poisoned pages. AccuRanker, in a post by Peter Emil Tybirk, put its own rate for that date at 1.4% — a gap of roughly 19x.

AccuRanker's numbers are not a denial of the phenomenon. The company reports that a large event began late on September 24; on September 25 its sample flagged 30.2% of desktop and 25.7% of mobile pages, falling to 4.5% and 4.0% on September 26 and 1.47% for October 1–9. It also says Google tightened detection again on October 15, mostly on mobile, where the rate reached 2.55% on October 16 before falling to 0.47% on October 17. Across 22 markets, its poisoned share ranged only from 1.1% to 1.7% — the difference is about how a vendor's requests look to Google, not which keywords a customer tracks.

The two companies also measure differently on purpose. Nozzle compares each page against a three-week baseline. AccuRanker's "sandwich check" flags a first page when its top 10 keeps fewer than half the sites seen the day before and fewer than half of those seen the day after, on a sample of one in every 200 tracked keywords. Neither figure is independently audited.

What the vendor responses do agree on is cost and depth:

SISTRIX (Johannes Beus, October 7) says it now publishes only results that pass several quality checks, re-collects keywords until a verified result exists, has disabled on-demand updates since September, and is concentrating on the top 10 because deeper positions "can no longer be compared reliably over time."
SE Ranking said on October 16 that Google had been "returning incomplete or unreliable results to rank trackers across the industry," causing false drops, and that it had added extra checks.
Semrush said the impact on its users has been "limited." DataForSEO posted on its status page; Advanced Web Rankings and Morningscore published notes. DemandSphere reported wrong results on about 11% of its daily checks and added an observability layer.

Practitioners described the same chaos from the outside. Lily Ray replied to Google's October 8 notice that the September 2026 spam update had finished with: "Trying to share some findings on this but rank trackers are too unreliable at the moment." Glenn Gabe documented a site that "got hammered on 9/29 during the spam update," where "ahrefs accurately picked up the drop, Semrush way late picking it up." Ryan Jones wrote on October 1 that "we're getting to the point where nobody will have rank tracking anymore." And on October 9, Dr. Pete Meyers announced on Bluesky that he had "documented and handed off MozCast as best as I'm able" — the industry's most-cited public volatility index changed hands in the middle of the mess.

Why This Matters

1. Your September and October reports may contain drops that never happened. The poisoning window (September 20 – October 9) sits directly on top of the September 2026 spam update, which began September 24 and completed October 8. Any ranking drop from those two weeks has three possible causes: a real spam demotion, a blocked collection, or a poisoned page. A client deck built on that data is not wrong about the number — it is wrong about the cause.

2. The false signal is concentrated exactly where people look first. Nozzle's data shows the failure mode clients notice: your tracked URL leaves the top 10 for a day or two while Reddit and Facebook take its place. That is a seductive story ("forums are outranking us"), and it is precisely the pattern the poisoned pages produced.

3. The substitution effect is real even outside the poisoning. Reddit, Facebook, LinkedIn, Instagram and Quora gaining share on swapped pages mirrors a genuine shift in the results Google serves to humans. Treat the poisoned data as noise, but do not dismiss the underlying direction: social proof and forum threads are competing for the same slots your content strategy is targeting.

4. Depth is being traded away. SISTRIX has retreated to the top 10. AccuRanker says one in 20 desktop pages and one in 12 mobile pages lack enough history for its comparison to work at all. Most tools now sample rather than count, which means some daily swings are measurement noise, not market movement.

5. The alternative data is thinner than it looks. Google Search Console does offer first-party data, and since August 31, 2026, a generative AI report for all sites — but that report shows impressions without clicks or queries for AI Overviews and AI Mode. Search Console only covers sites you own or verify. It cannot show a competitor's position, a market's share of voice, or which forum thread displaced you on a given morning.

How to Adapt Your Keyword Strategy

1. Never act on a single collection. The single most useful finding for practitioners is that 80% of poisoned spells lasted one collection and 77.9% of affected pages recovered within three days. Any drop you see should be confirmed by a second pull 48–72 hours later before it reaches a client or a content calendar.

2. Require a volatility floor before you rewrite anything. If a keyword moves fewer than five positions and returns the next day, log it as noise. Reserve action for movements that persist across two collection cycles and show a matching change in clicks or impressions in Search Console.

3. Triangulate three sources that fail differently. Use your rank tracker for direction, Search Console for first-party clicks and impressions, and a manual or low-volume spot check for the ten keywords that matter most commercially. A poisoned page produces a confident organic number — it does not produce a click. If rankings collapsed while Search Console clicks held steady, believe the clicks.

4. Move reporting from positions to outcomes. Positions are now a noisy proxy; impressions, clicks, assisted conversions and branded search volume are not. Present rank data with a stated confidence band and a note on the collection window, and tell clients explicitly which weeks are contaminated.

5. Separate the spam update from the collection failure in your audit trail. For any late-September or early-October drop you already reported, re-pull the data now and annotate it. Where available, cross-check against a second vendor or an archived screenshot. Distinguishing a real demotion from a bad page is the difference between a content fix and an apology.

6. Treat social and forum surfaces as competitors, and measure them. Reddit and Facebook gaining share on poisoned pages is a hint about where Google's ranking machinery is comfortable placing non-branded answers. If your keyword set is informational, build a presence where those threads live — brand mentions, community answers, and social profiles that can appear in the ten results you are trying to win.

7. Take your own snapshots of the keywords you cannot afford to lose. For a short list of revenue-critical terms, keep dated screenshots or saved HTML of the live results page. It costs minutes a week and is the only record that survives a vendor outage, a poisoning episode, or a vendor changing its methodology.

Key Takeaways

8.0% of SERPs collected by rank trackers since September 13, 2026 were poisoned — normal-looking pages with swapped results — up from 0.17% before.
A tracked site vanished from the top 10 on 58.6% of poisoned pages, against 2.7% at baseline.
Vendor measurements diverge wildly: 27% (Nozzle) vs 1.4% (AccuRanker) on the same day, a roughly 19x gap driven by collection method.
Incidents are short: 80% lasted a single collection, and 77.9% of pages recovered within three days.
The episode overlapped the September 2026 spam update, so real demotions and false drops are now mixed together in the same reports.
Verify every suspicious drop twice before changing strategy, and shift reporting from positions toward clicks and conversions.

FAQ

What exactly is a "poisoned SERP"?

A results page served to automated collectors that looks completely normal but lists different sites than a human would see. Nozzle's test: if fewer than half of a keyword's usual top-10 sites appear anywhere on the page, and they return later, the page was poisoned.

Is Google confirming this?

Google has made no public statement about blocking, CAPTCHAs or data injection as a coordinated campaign. Barry Schwartz's own reading, labelled as an assumption, is that the effort targets AI bots and scraping APIs such as SerpApi rather than the tools SEOs use. Google sued SerpApi in December 2025 and filed an amended complaint in 2026.

Should I stop using rank tracking?

No — but stop treating a single collection as truth. Every vendor that published methodology says it can detect most swapped pages at rising cost and reduced depth. Use trackers for direction, confirm with Search Console clicks, and re-pull before reporting.

Why did my rankings drop in late September 2026?

Three candidates: the September 2026 spam update (September 24 – October 8), a blocked collection, or a poisoned page. Check whether the drop persisted, whether Search Console clicks moved, and whether the same keywords recovered on their own within about three days.

Does this affect social media keyword research?

Indirectly, yes. On poisoned pages, Reddit (+8.0 points), Facebook (+5.5), Instagram (+2.5), LinkedIn (+3.1) and Quora (+1.4) all gained top-10 share. Some of that is the swap itself, but it also reflects where Google increasingly sources answers — a signal worth testing in your social and community keyword plan.

Conclusion

The uncomfortable lesson of the poisoned SERPs is that ranking data stopped being self-evidently true. A blocked request is visible; a fake page is not. The vendors who published methodology deserve credit for saying so, but their numbers disagree by a factor of nineteen, which means no customer can currently tell which world their dashboard is describing.

The practical response is not to abandon rank tracking. It is to demote it: confirm every drop twice, triangulate with first-party click data, keep your own snapshots for the keywords that pay the bills, and report outcomes rather than positions. Keyword strategy built on one noisy number is a strategy with an unmeasured error bar.

If you want to build keyword sets that survive this kind of measurement chaos — clusters grounded in intent, seasonality and social demand rather than a single day's position — start with SocialKeywordGenerator and generate keyword ideas you can validate across channels, not just against one vendor's top 10.