Somewhere in late September, a rank tracker asked Google who ranks for "white label local seo." Google said white label SEO agencies. Reasonable.
Three days later, it asked again. This time Google said a steakhouse in Jackson Hole and USA.gov.
Now, I have never ordered a ribeye and received a white label local SEO package. But according to the data, I could have. That example comes fromNozzle's research on poisoned Google SERPs, and it's the funniest possible version of a problem that's going to cost a lot of SEOs some very unfunny client calls this quarter.
Here's the short version: Google is feeding fake results to rank trackers. Your dashboard may be showing drops that never happened. And if you run a link building campaign, you need to know about this before your client opens their monthly report and sees a sea of red arrows.
What's actually happening
Nozzle, an enterprise rank tracking company, analyzed 27.5 million Google results pages across 49 countries. Before September 13, 2026, about 0.17% of the pages they collected looked tampered with. After September 13, that number jumped to 8.0%.
And "8%" undersells the bad days. On September 29, roughly half of the pages Nozzle collected for Canada came back poisoned, according to Ryan Doser's breakdown of Nozzle's public data. Across the whole sample, the daily rate peaked around 27%.
A "poisoned" page isn't an error. It isn't a captcha. It's a complete, normal-looking results page where most of the sites that usually rank have been quietly swapped out. Nozzle flags a page as poisoned when fewer than half of a keyword's usual sites show up. Nothing on the page tells the tool it got punked. The tool saves it as real, and your report treats it as real.
When that happens, the tracked site is missing from the top 10 in about 58.6% of cases. That's your "we fell off page one" moment, courtesy of absolutely nothing you did.
Why Google is doing this (probably)
Google hasn't commented. But the industry consensus is that rank trackers are collateral damage in a much bigger fight.
AI companies scrape Google's results to ground their answers. Google would prefer they didn't. So Google has been escalating. Barry Schwartz at Search Engine Roundtable laid out the timeline: the num=100 parameter disappeared in 2025, goto redirects showed up in July, human verification checks got more aggressive, and now Nozzle's Derek Perkins describes a three-part approach of wide IP blocking against residential proxy networks, a lot more captchas, and injecting bad data into suspicious requests.
Rank trackers collect results the same way AI scrapers do. Same proxies, same automated requests. So when Google sets a trap for the AI bots, the rank trackers walk right into it too.
It's like your neighbor setting up a sprinkler to keep deer out of the garden, and you're the mailman.
The catch: some of those drops are real
This is where it gets annoying. Google's September 2026 spam update ran from September 24 to October 8, right on top of the worst poisoning days.
So you have two things happening at once: real ranking losses from a real update, and fake ranking losses from poisoned data. And the tools don't agree with each other. Glenn Gabe shared an example of a site that got hit in the spam update where Ahrefs caught the drop, Semrush caught it late, and Sistrix didn't show it at all.
Which means the lazy answer, "ignore every drop since September," is just as wrong as panicking over every drop. You have to actually check.
How to tell a poisoned drop from a real one
Check Search Console first. This is the big one. Pull every keyword your tracker says fell out of the top 10 since September 13, then look at that page's impressions and clicks in Google Search Console for the same dates. If GSC is flat and the tracker says you vanished, Google lied to the robot, not to you.
Wait three days. Poisoning is short-lived. Nozzle found that 80% of poisoning spells last a single check, and 77.9% of poisoned pages had their usual sites back within three days. A drop that bounces right back is suspect by default.
Look for the fingerprints. Poisoned pages have a type. Social and forum sites show up more often (Reddit appears in the top 10 of 28.8% of poisoned pages versus 20.8% normally, with Facebook and LinkedIn close behind). AI Overviews show up less often (34.9% versus 54.2%). If a SERP suddenly looks like Reddit and LinkedIn threw a party, be suspicious.
Read your vendor's status page. Most of the big tools have posted something. SE Ranking says it has corrected affected dates and about 2% of results are still affected. Semrush says it added extra filtering when it noticed the issue in late summer and that most remaining problems are beyond page one. Know what your tool has done before you trust its history.
What this means for link building
Here's my actual grievance.
For years, the link building industry let rank tracker screenshots become the scoreboard. Build links, show the arrows go up, collect renewal. That was always a little fragile, because rankings move for a hundred reasons that have nothing to do with your links. Now the scoreboard itself is getting tampered with.
If your client judges a link campaign by a third-party rank tracker this quarter, they might fire you for a steakhouse in Jackson Hole.
So let's measure the stuff Google can't poison:
- Search Console impressions and clicks. First-party data from Google itself. Not perfect, and it still won't show you AI Overview or AI Mode clicks separately, but it's not a scraper getting fed junk.
- The links themselves. A link on a real publication either exists or it doesn't. It's live, it's indexed, it sends referral traffic or it doesn't. You can verify it by visiting the page, which no amount of SERP poisoning changes.
- Business outcomes. Organic leads, organic revenue, branded search growth over time. The stuff the client actually cares about when they're not staring at arrows.
The links are the asset. Rankings are a symptom. And right now, one of the thermometers we use to read that symptom is broken about 8% of the time and much worse on bad days.
That doesn't make rank trackers useless. They're still great for spotting trends, finding opportunities, and watching competitors. You just can't treat one red arrow as a verdict anymore. Treat it as a question, then go answer it with data Google can't mess with.
What to do this week
If you manage SEO or link building for anyone besides yourself, send a short note now, before anyone notices the red arrows. Something like: "Industry-wide, Google has been serving bad data to rank tracking tools since mid-September. If you see sudden drops in your tracker, we verify them against Search Console before drawing conclusions." Two sentences. Saves you a very awkward call.
Then audit your own reports. Flag every drop since September 13, run the GSC check, and separate the real spam update casualties from the fake ones. The real ones need work. The fake ones need a footnote.
