Fake Google SERPs: how to spot them and check your own scraper

A Google scraper can log a flat block rate on a day when a third of its pages are wrong. On October 21, 2026, Nozzle judged 35.7% of SERPs on pages 1 and 2 as poisoned, with no errors or CAPTCHA to flag them. These are fake Google SERPs. In a rank report, they look like a crash: since September 13, a site that usually ranks in the top 10 was missing from it on 60.8% of poisoned pages, against 2.7% on normal pages.

What are fake Google SERPs, and how do they differ from SEO poisoning?

Fake Google SERPs keep Google’s template, ads, and Shopping block, but replace most of the organic sites a keyword usually shows. Google serves them to automated requests with HTTP 200 and no CAPTCHA, so nothing in the response marks them. Nozzle, the rank tracker that first measured them, calls them poisoned SERPs.

Its rule: a keyword’s usual sites are those in its top 10 on at least 60% of its SERPs during a baseline period. A page is poisoned when fewer than half of them appear. In one of Nozzle’s examples, an iPhone search for “heating and cooling services queens,” targeted to Queens, New York, lost 8 of its 10 page-1 sites between two checks one to three days apart.

Don’t confuse this with SEO poisoning, which MITRE ATT&CK describes as manipulating search rankings to lure victims to malicious pages. SEO poisoning targets people; fake Google SERPs target bots.

Why a poisoned SERP does more damage than a blocked Google request

Google’s other defenses are loud. A blocked request gets the “unusual traffic” message, which “most likely shows a reCAPTCHA,” according to Google Search Help, and the scraper retries. Fake Google SERPs trip none of the alarms a scraper usually watches. The table shows which signal appears in your scraper’s data for each kind of response.

Only comparing the page with the keyword’s usual sites exposes fake Google SERPs, so your pipeline has to keep a history of past results.

Every poisoned page still costs a request, but the higher cost comes after it’s stored. A fake drop sends an SEO team after a problem that doesn’t exist. Someone rewrites a page that never lost its ranking, shifts budget away from a channel that still works, or explains a crash to a client. 

Data teams feed the same pages into price and visibility dashboards that other teams plan around. And with Google’s September spam update running at the same time, a real drop and a fake one can show up in the same week. Since mid-September, every drop needs a second check before anyone acts on it.

Google SERP data collection changes that led to poisoned pages

Fake Google SERPs follow 20 months of Google raising the cost of automated access:

Nozzle’s initial October 10 release called poisoning “Google’s response to AI scraping and grounding.” Google hasn’t confirmed that, but its spam policies already list “scraping results for rank-checking purposes” as machine-generated traffic.

Since mid-2026, a Google Search redirect sits in front of result links. When SERP links are redirected through google.com/goto, the destination isn’t readable from the HTML, which is now an issue when scraping Google SERP URLs.

What the data shows: how often, how long, and which searches get hit

Nozzle’s data through October 21, 2026, covering 56.1 million judged SERPs, shows:

• 22.6% of SERPs judged on both pages 1 and 2 were poisoned since September 13, against 0.28% before
• 8.7% of all SERPs were poisoned on page 1 alone, against 0.17%
• The peak hit 43.5% on September 30, and October 21 reached 35.7%
• 67.9% of poisoned pages had their usual sites back within three days, and 92.5% within two weeks

On 58.4% of SERPs poisoned on page 2, page 1 still looked normal, so positions 11–20 can break while the top 10 looks fine. On page 1, the rate also depends on the query, industry, and market:

Other trackers publish lower rates for fake Google SERPs because they use different definitions and collection routes, and some re-fetch suspicious pages before storing them. E.g., AccuRanker reported about 1.5% a day for October 1–9, roughly a fifth of the figure in Nozzle’s first release.

Who else gets bad data: AI agents, visibility analytics, and SERP APIs

AI agents that ground answers on Google results can cite the wrong sources because fake Google SERPs don’t flag errors. Even the AI Overview sources on those pages change. Share of voice dashboards inherit the same false drops you see in rank reports. AI teams should check content before grounding. If you buy data from a SERP API, ask how the provider validates pages.

How to spot a poisoned Google SERP by looking at the results page

Six signs point to fake Google SERPs:

• Most usual sites vanish at once: organic results keep 22.3% of the previous SERP’s sites, against 88.1%
• Social platforms fill the gap: Facebook is in the top 10 of 29.5% of poisoned SERPs, against 21.9% of the same keywords’ other SERPs, so a Facebook result alone proves nothing
• Foreign sites appear: 12.4% of poisoned US SERPs have a foreign country-code site in the top 10, against 6.2%
• Short pagination: on deep desktop keywords, pages stopping at page 4 or earlier rose from 0.19% to 32.5% on the worst day
• SERP features change: “People also search for” keeps 34.2% of its searches, against 87.6%, and AI Overview sources keep 37.5%, against 68.1%
• Local results move: businesses from other cities appear under your city’s name, per AccuRanker

Ads and Shopping barely move, so in Google Shopping monitoring, a stable Shopping block next to scrambled organic results points to poisoning. No single sign is proof, so treat each as a reason to re-check, not to delete data.

How to tell a fake ranking drop from a real one in your rank tracker

Sort the checks by when you can run them, not by how important they look:

Right away, on the data you already have:

1. Check whether your usual competitors dropped on the same day, using the signs above.
2. Compare the page with the keyword’s usual sites over the past weeks. Yesterday’s page is a poor reference, since it may be fake as well.

Over the next one to three checks:

1. Wait. Four in five poisoning spells last a single SERP, so most fake drops reverse on their own.
2. Match Search Console data by query, page, country, and device once that day’s data appears, which usually takes a couple of days.
3. Re-check from a different IP in the same city or market you track.

If the drop survives day three, look for a cause on your side: the September 24 – October 8 spam update, a deploy, or a lost link to that page.

Google SERP volatility in client reports: what to annotate and ask

While fake Google SERPs persist, I’d give every drop in a client report one of three statuses:

Annotate reports from September 4, 2026, when Keyword.com saw an early wave of swapped results, before the main one. One report line covers it: “Rank checks on these dates may include incorrect Google results; one-day drops are unconfirmed.” Weigh top-10 counts above top-100 counts, and export Search Console data for the period. Then ask your Google SERPs tool what share of its stored SERPs failed its check yesterday, whether it re-checks pages before storing them, and whether it corrected affected dates. If it can’t answer, a rank tracker with API lets you run these checks on your rank tracking data. 

How to check your own Google scraper for poisoned pages before storage

If you collect Google results in-house, through a homegrown crawler or proxies for SERP monitoring, fake Google SERPs land straight in your data pipeline. These four checks catch them before storage:

Why success rate and block rate can’t see poisoned Google pages

Since a poisoned page returns HTTP 200 and parses cleanly, the check has to look at content. The rule from the definition above makes a ready threshold. List the domains in a keyword’s top 10 on at least 60% of past collections, and treat a page showing fewer than half of them as invalid. Count only passing pages as valid responses, and track that rate daily next to block rate. A flat block rate with a falling valid response rate means poisoning, not blocking.

Use control queries with a known first page as an early alarm

Control queries, or known-answer queries, are searches whose first page you can predict: official sites, category leaders, and brand queries, which are poisoned least. I’d start with a dozen or two per market and run them through the same exits as production. Their match rate, the share of expected first-page domains present, should stay within its own range from recent weeks. When a day falls below it, flag that day’s keywords, including new ones.

Re-check suspicious pages through a second route in the same market

When a page fails the content check, re-fetch it minutes later from a different IP address in the same market, in a new session. If the usual sites come back, the first page was poisoned. If both routes agree, store it as a real change. Changing device alone is a weak check, because Nozzle measured almost the same rates on desktop (8.8%), iPhone (8.8%), and Android (7.7%). So for the re-check, change the IP and session, not the device.

Measure the poison rate per collection route, not only the block rate

AccuRanker found that Google decides whether to show a poisoned page per browser session, so poisoned SERPs follow how data is collected, not what you track. After each of Google’s changes, AccuRanker adjusted how it collects results, while sessions without the change were still poisoned at the same time. Poison rate is pages that fail the content check divided by pages that returned HTTP 200; log it by route, country, and provider. A route with few blocks and many fake Google SERPs can cost more than one that fails loudly.

For local SERPs, geo-targeting must match the market. Proxy-Seller is a proxy infrastructure provider that offers residential proxies in 220+ locations with city and ISP targeting, ethically sourced and DPA/SCC ready. For long-running tracking in one country, ISP proxies give you dedicated static IPs.

Fake Google SERPs: what SEO and data teams should do this week

Google hasn’t commented on fake Google SERPs, and the latest daily rate was more than 100 times the 0.28% baseline.

My rule for SEO teams: don’t report a drop until it survives three checks and Search Console agrees. Data teams should add control queries, re-check failed pages through a second route, and log the poison rate per route.