Poisoned Google results peaked at 27% of Nozzle's SERPs on Sept 29, its study finds

A poisoned page gives a tracker nothing to flag. Nozzle says these pages throw no error or captcha and are built on a real results page's template, but most of the keyword's usual sites are missing ^[2]. We'd expect a tracker to log that as a lost ranking.

At 8.0% of 17.8 million judged SERPs, the study implies about 1.42 million poisoned pages ^[16]. That rate is roughly 47 times the 0.17% baseline ^[17].

Both figures come from Nozzle's own sample, and Nozzle is an enterprise rank tracker ^[14]. They transfer to another tracker only if Google treats that tracker's fetches the way it treats Nozzle's. Nozzle's premise is that trackers get caught because they all collect SERPs the same way ^[19]. Google has not confirmed any of it ^[20].

Nozzle's data also stops on October 9 ^[2]. TrueRanker's write-up, updated October 15, says most of the obviously irrelevant results are fixed. It adds that Google is also serving pages whose results fit the query and still are not the real ones, and those are much harder to spot ^[21].

Search Console is the control because it counts clicks and impressions from actual searches, so a page served to a bot never shows up in it ^[10]. Nozzle's checklist closes on the same advice: when a site "disappears" in a tracker but keeps getting impressions and clicks in Search Console, the site itself was not hit ^[11].

The DEV Community author automated the comparison. The script reads a tracker CSV with date, query and position, with position left empty when the site was not found. It flags every date on which a keyword fell out of the top 10, fetches Search Console data for those dates and outputs a verdict ^[12].

Setup is a one-time cost. Create a Google Cloud project, enable the Search Console API, make a service account with a JSON key, then add the account's email under Settings > Users and permissions. Read access is enough. Skip the last step and every call fails with a 403 even though the key is valid ^[13].

The check has a limit. The September 2026 spam update started on September 24 and ran 13 days and 16 hours ^[8]. The September 27 to 29 peak falls inside that window ^[18]. A drop on September 29 could be the update, bad data, or both ^[8].

In Search Console, impressions that held up point to bad data in the tracker. Impressions that fell point to something real, with the update as the obvious suspect. Because most spells are short, a drop that reverses within a few days fits the poisoned pattern better than it fits a penalty.

In our view the check is cheap for a site you own. It covers only properties you can add a service account to. The post does not offer a comparable check for AI-citation data.