Poisoned SERPs: Why Your Rank Report May Be Wrong and How to Check It

Poisoned SERPs are Google results pages, collected by rank-tracking tools, that look normal but have most of a keyword's usual websites swapped out. Since mid-September 2026 they have made sites appear to crash in rank reports when nothing changed. Before you act on a drop, check that query's impressions and clicks in Google Search Console.

Google has not commented. Vendors say a minority of their checks are affected on average, and most spells clear within days or weeks. Here is what their data shows as of 4 November 2026, and how to test your own report.

What are poisoned SERPs?

Poisoned SERPs are search results pages that look like ordinary Google results but leave out most of the sites that usually rank for a keyword, and they are being served to automated rank checks.

The label is most closely tied to Nozzle's study of poisoned Google SERPs, first published on 10 October 2026 and updated on 1 November. Nozzle calls a page poisoned when fewer than half of a keyword's usual sites appear anywhere on it. On those pages, the organic results kept 29.1% of the sites from the keyword's previous SERP, against 88.2% on normal pages. Social sites filled the gaps, Facebook most of all.

Semrush said on 27 October that some automated requests return pages that "differ from what a typical user would see", and called it an industry-wide issue. Its example: a search in Brazil for a baby stroller model returned a dental supply store's equipment page, because both shared the Portuguese word "carrinho".

Search Engine Land's Barry Schwartz first reported tracking problems on 15 September. Search Engine Journal analysed Nozzle's findings on 14 October.

How much rank-tracking data is affected?

Estimates run from about 5% to more than a quarter of tracked results pages, depending on the vendor, the dates and the method, and the figures are not directly comparable.

Nozzle's 1 November update covers 66.7 million judged SERPs across 58 countries, 40.6 million of them since 13 September. Its 26.9% compares with a 0.28% baseline before the problem began. The daily rate hit 64.0% on 31 October, well above the September peak of 43.5% on 30 September. Page 1 alone peaked at 34.8% on 27 October. Page 2 was poisoned about one and a half times as often as page 1.

Keyword.com, also updated on 1 November, found 13.1% of its tracked results poisoned from 13 September to 14 October, against 0.3% in August. Its rate peaked at 34% on 30 September and settled at about 7 to 8% from 8 October. Singapore-headquartered Ahrefs said on 22 October that it was seeing "between 5% and 20% of search results affected", depending on the data provider.

Other vendors' figures come from Search Engine Land's 27 October round-up. AccuRanker saw 40% of initial desktop requests affected on 24 October, 3.2% after its checks and under 1% the next day. BrightLocal said the problem sat mainly below position 10.

Singapore is in both main datasets. As of Nozzle's 1 November update, 26.6% of 131,236 judged google.com.sg SERPs had been poisoned since 13 September. Keyword.com reports 11.5% for google.com.sg over 13 September to 14 October. The gap is not a contradiction: Nozzle's window runs through the late-October surge, and the two firms track different keywords with different tests.

The effect on individual sites is sharp while it lasts. Nozzle found a project's own site missing from the top 10 on 63.5% of poisoned SERPs, against 2.6% normally. Keyword.com puts it at 72%.

Why is Google doing this?

Google hasn't said, but the timing and its own rules point to a crackdown on automated scraping, with rank trackers caught in it.

Google's spam policies, last updated on 28 August 2026, list as machine-generated traffic "scraping results for rank-checking purposes or other types of automated access to Google Search conducted without express permission". In December 2025, Google sued the scraping company SerpApi, accusing it of circumventing security measures and reselling content. That shows Google acting against scrapers; it does not prove a link to poisoning.

Nozzle's reading is blunter: "It is Google's response to AI scraping, and rank trackers are caught in it." That is Nozzle's interpretation, not a Google statement.

Don't confuse this with the September 2026 spam update, which ran from 24 September to 8 October. The tracker problems began earlier, on 13 September, and have outlasted it.

As of 4 November 2026, we could find no comment from Google.

How do you check a ranking drop against Search Console?

Open the Performance report in Google Search Console and look at the same query, dates, country and device as the drop. If impressions and clicks held steady, the drop probably happened in the tracker, not on Google.

1. Open the report. In Search Console, go to Performance, then Search results. Our guide to Search Console's Performance report covers the basics. Filter by the query, or by the page plus a query filter. Cover the drop's dates and compare with the previous period.
2. Match the settings. Filter Countries to Singapore and Devices to match the tracker (mobile or desktop). Google says the newest data can be preliminary, so be wary of the last day or so.
3. Read impressions and clicks first. Average position is "the average position of the topmost result from your site", taken across real searches that vary by time, place, device and history. It will never match a tracker's single snapshot exactly.
4. Check the keyword's history. Compare the result with several weeks of checks, not just yesterday's, which may have been poisoned too.
5. Look at page 2. Nozzle found it poisoned more often than page 1.
6. Wait for the next few checks. Keyword.com says 78% of poisoned pages had their usual sites back within three days. Nozzle says 46.9% within three days and 90.4% within two weeks, and that two in three spells cover a single check.
7. Ask your tool or agency. Does it filter suspect results, and has it revised stored September and October data? Ahrefs says it is cleaning up past results. SEOmonitor may keep showing the previous rank for up to two daily updates after an unusually large drop, according to Search Engine Journal. Keyword.com added rank verification in late October. Check before re-sending old exports to a client.

Nozzle's rule of thumb: if a site "disappears" and Search Console still shows impressions and clicks, nothing happened to the site.

If impressions fell too, the drop is probably real: look at indexing, technical faults, competitors and algorithm updates. That is the point to bring in technical SEO and reporting that goes beyond rankings.

One caveat: in a 3 November contributor piece, Ryan Jones of SERPrecon suggests trackers' repeat searches could inflate Search Console impressions and lower CTR. That is his hypothesis, not established fact.

Should you worry about scam ads and fake pages in search results?

Poisoned rank data is a measurement problem, but a separate and real risk is that scammers place lookalike pages and fake contact numbers in Google results and AI answers, so it is worth knowing what to watch for.

The two issues are not connected: nobody has shown that poisoned SERPs reach real searchers.

On 21 October 2026 the Singapore Police Force warned of phishing sites impersonating SIMBA that appeared among the top sponsored results on Google. At least 62 cases had been reported since March 2026, with losses of at least $83,000. The police advise using a saved bookmark or typing the known address, and calling the ScamShield Helpline on 1799 if in doubt.

Hacked sites are the other route. The Cyber Security Agency's advisory, Protecting Your Website From Cyber-Attacks (6 April 2026), warns that "defaced websites and unauthorised website redirection could result in SEO (search engine optimisation) poisoning". Its measures include automatic updates, two-factor authentication, a web application firewall, file integrity monitoring, referer-based checks for redirects and offline backups. Report incidents through the SingCERT incident reporting form.

On 21 October, Check Point Research reported fake support numbers for more than 20 travel brands, hosted in PDFs on university and government sites and repeated in Meta AI summaries. On 27 October, The Points Guy reported Google AI Mode citing a hacked University of California Merced page. Google told the publication: "Our anti-spam protections are highly effective at keeping scams out of our features and showing official customer support numbers where possible."

For an SME, the defence is housekeeping. Publish your official phone, WhatsApp and address in one consistent place on your site and your Google Business Profile. Search your brand name plus "contact" or "hotline" now and then, and check how your business shows up in AI Overviews. Tell customers which channels you use, and keep your business details consistent for AI search.

What should Singapore businesses do now?

Don't change a page because of one bad rank check; confirm it in Search Console, ask how your reports are verified, and judge SEO by enquiries, not by positions alone.

• Verify any drop in Search Console before reacting.
• Check page 2 and the keyword's history.
• Wait three days for the next checks.
• Ask your vendor or agency about filtering and revised data.
• Annotate September and October 2026 in reports.
• Keep official contact details identical everywhere.

Rankings alone don't grow a business. At Plexial, we've helped a service-based business achieve 3.4× more qualified leads from organic search, showing why SEO should be measured by business results, not just keyword positions. Use Search Console's Performance report to see which queries bring enquiries, and measure SEO against those.

If your rank report and Search Console disagree, send us both reports and we'll tell you which one to trust.

At Plexial, we monitor keyword rankings using Google Search Console and our own in-house tracking tools. This helps us compare ranking movements with actual search performance and identify opportunities for improvement.

Frequently asked questions

What does "poisoned SERP" mean?

It is a Google results page served to an automated rank check that looks normal but leaves out most of the sites that usually rank for the keyword. Nozzle counts a page as poisoned when fewer than half of the usual sites appear. Vendors say it makes sites look as if they dropped. Google hasn't commented.

Is my website really losing Google rankings?

Possibly not. Open Search Console and check impressions and clicks for the same query, dates, country and device as the drop. If they held steady, the tracker probably recorded a poisoned page. If they fell too, treat the drop as real and look at indexing, technical problems, competitors and algorithm updates.

How long do poisoned results last?

Usually days, sometimes longer. Keyword.com says 78% of poisoned pages had their usual sites back within three days. Nozzle's 1 November update says 46.9% within three days and 90.4% within two weeks, and that two in three spells cover a single check.

Do real customers see poisoned results?

There is no evidence either way. The vendors' data comes from automated checks, and Keyword.com says its figures "can't show what a real searcher saw". Steady Search Console impressions and clicks during a reported drop suggest real searchers kept finding your page.

Why doesn't Search Console match my rank tracker?

Search Console averages real searches and reports the position of your topmost result, and Google notes results vary by time, place, device and search history. A tracker takes one automated snapshot from one location and device. They differ even in a normal week.

Which rank trackers are affected?

Semrush calls it industry-wide. Ahrefs, AccuRanker, SISTRIX, SEOmonitor, DemandSphere, Keyword.com and Nozzle have all reported it, and several now filter or recheck suspect results before they reach reports. Any service that collects Google results automatically can receive these pages, Keyword.com notes.