Poisoned SERPs: How Nightwatch Keeps Google’s Fake Results Out of Your Rankings

Quick Takeaways

• Since late September 2026, Google has been answering automated searches with results pages that look real but list different organic results. The SEO community calls them poisoned SERPs.
• They come in three shapes: swapped pages (different sites on page 1), cut-down pages (results stop early) and wrong-location pages (another city’s businesses on a local search).
• Google has tightened its detection several times since. The sharpest steps we saw were in mid-October, on October 20-21 and on October 23-24.
• A poisoned page does not look suspicious on its own. You only catch it by comparing it with the keyword’s history, which is what Nightwatch does for every page before it reaches your dashboard.
• Nightwatch defends in six layers, from checking the browser session before a search to repairing bad days after they are stored.
• If you see a one-day drop on one of the key dates, run the checklist below before you react.

Google is now actively feeding rank trackers the wrong pages. This is not a rumour or a single vendor’s bug. We saw it in Nightwatch’s own data from the first night, diagnosed it within days, and had checks in production before it became a public topic.

This article explains what changed, when, what a poisoned SERP looks like, and exactly how Nightwatch stops one from becoming a fake ranking drop in your reports.

Table of Contents

1. What is a poisoned SERP?
2. How Nightwatch caught it early
3. Key dates: the timeline so far
4. The three shapes of a poisoned SERP
5. Why Google is doing this
6. How Nightwatch detects and handles poisoned SERPs: six layers
7. What we tried that does not work
8. How to spot a poisoned SERP in your own data
9. What to do in Nightwatch
10. Where this leaves us

What is a poisoned SERP?

A rank tracker works by searching Google for your keywords, in your locations and on your devices, and recording where each site appears. It does this for millions of keywords a day.

A poisoned SERP is a page Google returns to that search that looks completely normal (the familiar layout, the ads, the AI Overview) but whose organic results are not the ones a real searcher gets. Google sends no error and no captcha. The page arrives with a clean response, and a naive tracker stores it as the truth.

The damage shows up as ranking changes that never happened:

Wednesday sends you looking for a penalty, a technical issue or a lost backlink. In reality, nothing happened to your site. The tracker was handed a different page. The tell is the second column: when most of your usual competitors disappear on the same day, the page changed, not your rank.

It can also go the other way. A poisoned page can carry your site, just at a very different position. In one case we investigated, a site that sat at #17-19 for weeks was shown at #1 on Google’s alternate page. A jump like that is just as wrong as a drop, and harder to notice because nobody complains about good news.

How Nightwatch caught it early

We did not learn about poisoned SERPs from a forum thread. Nightwatch’s own checks raised the alarm in the first days after the onset:

• The first nights (Sept 24-26): the completeness check fired. Keywords that had returned 30-50 results for weeks suddenly came back with 2-7, on a clean response with no error and no captcha. On one account, all 49 keywords we examined collapsed the same way at the same time. A ranking tool that stores what Google returns would have recorded those as lost rankings.
• Within days (Sept 28-29): we traced it to the session, not the keyword. The same keyword, asked at the same moment, came back full through one browser session and thin or altered through another. For a local search such as home care service in a small Tennessee town, a clean session returned 49 results with 22 naming the local area, while a flagged session returned 19 with only 2. The search had not changed. The session had.
• By Sept 30: the identity check was live. Every page that loses a keyword’s recent position is now compared with the pages that keyword ranked on before it is stored.

That is the pattern we have followed at every step since: measure it in our own data, find what decides it, ship a check, and verify the check against a clean read.

Key dates: the timeline so far

These are the dates that matter if you are reading your own ranking history. “Google’s step” means a change on Google’s side. “Nightwatch” means what we shipped in response.

If your rankings show a sudden one-day drop around September 24-26, mid-October, October 20-22 or October 23-25, treat it as suspect until you have checked it.

What October 20-21 looked like in our data

October 20-21 was the clearest step. On our desktop collection, the share of first fetches that our checks rejected as the wrong page went from 4.4% to 16.4% overnight. On mobile it went from 0.4% to 13.3%. The pages were not subtly different: Google dropped the head of the page and refilled it from results that sat at #11-50 the day before, plus forums, video and marketplace listings.

We know those rejections were right because we checked. A few days later we paired 55 rejected pages with a same-hours read of the same query from a clean, direct connection. 53 of 55 were a different page entirely, and the real page carried the tracked site in 54 of 55. The rejected pages were fakes, and the rankings they would have recorded were wrong.

The three shapes of a poisoned SERP

1. Swapped pages

Page 1 looks normal but most of the usual sites are gone. This is the shape that produces the classic “dropped out of the top 100 for a day” chart. Google appears to decide per browser session, not per keyword: two searches for the same keyword at the same moment can get different pages. That is why it tracks how data is collected, not which keywords you track.

2. Cut-down pages

The results simply stop early. A keyword that normally returns 30-50 results comes back with 4 or 5, with no error and no notice. When we looked at 49 keywords on one account, every one had returned 28-50 results in the two weeks before the onset, then collapsed to 2-7 in the first two days after it. If your site ranks #25 and the page stops at #10, a naive tracker records you as “not ranked”.

The tricky part is that some searches really do have few results. A rule like “fewer than 10 results is bad” either rejects honest short pages forever or lets thin fakes through. The only reliable reference is the keyword’s own history, which is how we handle it (see layer 3).

3. Wrong-location pages

On a local search, a poisoned page can ignore the location you track and list businesses from another city, or return the national page instead of the local one. For local SEO this is the most damaging shape, because the wrong page is still full-length and looks plausible. It is caught the same way as a swapped page: the keyword’s usual local results are missing.

Why Google is doing this

Google has made no statement. The most likely explanation is a crackdown on bulk automated searching, much of it now driven by scraping for AI answer engines, with rank trackers caught in the middle. Instead of blocking automated traffic with a captcha (which a scraper can detect and retry), Google answers it with a plausible but wrong page, which is much harder to detect.

What matters for you is the practical consequence: a rank tracker can no longer assume that the page Google returned is the page a real searcher would see. Every page has to be checked.

How Nightwatch detects and handles poisoned SERPs: six layers

No single check catches every poisoned page. A fake can be full-length, carry your site, and look normal. So we use six layers, each designed to catch what the previous one missed.

Layer 1: Prove the browser session before trusting it

Because Google poisons per session, the best place to stop a fake is before the search. On desktop, every Nightwatch browser session runs a reference search first, and its result is compared with a known-good answer. A session that gets Google’s alternate page is retired and replaced before it can collect a single keyword for you. On mobile, where reference searches have proven a less reliable signal so far, layers 2 to 4 carry this work while we keep testing.

Since the last week of October, the desktop check runs before every job, not once per session. Sessions can turn bad mid-life, and checking once let some of those through. Checking every job cut desktop first-fetch fakes by about three quarters.

Underneath this sits the ordinary work of collecting like a real searcher: real browser engines with consistent device profiles for desktop and Android, language, clock and location settings that match each search, and full rendering of the page rather than scraping raw HTML.

Layer 2: Check the page as it is captured

Every page is checked the moment it arrives:

• Blocks and challenges. Captcha walls, “unusual traffic” pages and identity interstitials are detected and the session is rotated.
• Empty or half-rendered pages. A page captured before Google finished rendering its results is caught and fetched again.
• Full depth. We follow Google’s pagination to collect the full result set, so a ranking at #40 is read off a page that actually reaches #40.

Layer 3: Check that the page is complete, against the keyword’s own history

A cut-down page cannot be judged on its own, so we judge it against the keyword:

• History-based floor. Each keyword must return close to the best result count it achieved over the last 32 days. Using the best count, not yesterday’s, means a run of cut-down days cannot quietly lower the bar.
• Too short to say. If a page stops before the position your site held last time, it cannot tell a lost ranking from a page that did not go deep enough. On a single day in early October, 621 false drops on our platform came from exactly this. Such a page is fetched again instead of being stored as “not ranked”.
• Real short pages still get through. When Google itself ends the result set and repeated captures agree, the short page is accepted. Some searches really have few results, and we do not want to hold those keywords without data.

Layer 4: Compare every page with the keyword’s history before storing it

This is the identity check, and it is the core of our defence against swapped and wrong-location pages.

• If your site disappeared, page 1’s top 10 domains are compared with the pages the keyword ranked on in recent days. If the page shares too few of them, it is not the same page. It is rejected and the keyword is fetched again with a different session.
• If your site is found (since October 20-21), the head of the page must carry the domains that led the keyword’s recent pages. This catches the alternate page that happens to include your site, often at a very different position.
• If your site is where it has stood for days (since October 23-24), the position is accepted. This keeps the check strict where fakes do damage, on jumps into and drops out of the top 10, without throwing away good pages.

A real change still reaches you. When a new competitor genuinely appears, or your site genuinely drops, repeated fetches through different sessions agree, and the new page stands.

Layer 5: Repair bad days after they are stored

Some fakes will always get past the checks on a bad night, so we also look back. A repair pass finds keyword-days whose stored page broke sharply from the day before while the day before agreed with its own previous day, and keyword-days with no result at all, and restores them from the last good result. The copy is marked as a copy, so a real capture later in the day still replaces it.

After Google’s step on October 20-21, this pass repaired 127,010 wrong results and filled 269,537 missing ones in about seven minutes.

Layer 6: Keep one-day spikes out of your alerts and reports

Even a correctly stored one-day movement should not set off alarms. Nightwatch’s ranking insights compare each keyword with its rolling median rather than with yesterday, scale by how volatile that keyword normally is, and require a change to hold for two days before it is flagged. An oscillating or one-off reading cancels itself out instead of landing in your inbox.

What we tried that does not work

Being open about dead ends is part of trusting the data, so here are the shortcuts that sounded right and failed when we measured them:

• “Too few results means fake.” Poisoned pages are often padded, not thin. In one test, degraded pages carried more page-1 items than clean ones (11.3 against 7.9 on average), with editorial sources replaced by forums, videos and off-topic pages.
• “Agreement on retry proves it is real.” For wrong-location pages, a bad connection returns the same wrong page every time. Two identical fakes are still fakes, which is why the identity check compares with history, not just with another fetch.
• “Use one fixed test keyword to grade sessions.” A single canary keyword asked at a single moment says little about the specific page being collected. We grade sessions on reference searches matched to the job instead.

How to spot a poisoned SERP in your own data

Before you act on a sudden ranking drop, in any tool, check these six things:

1. Does it reverse the next day? A one-day drop out of the top 100 that is back the next day is most likely bad data, not a penalty. See our guide to diagnosing ranking drops for what a real drop looks like.
2. Did your competitors vanish too? Open the stored SERP. If many of your usual competitors disappeared on the same day, suspect the page, not your site.
3. Is the date one of the key dates? September 24-26, mid-October, October 20-22 and October 23-25 are when Google’s changes hit hardest.
4. On local searches, are the businesses in the right city? Results from another town are a sign of a wrong-location page. Our guide to tracking local rankings covers how local SERPs should behave.
5. What does Google Search Console say? Filter the Performance report by the same query and date. If your average position and clicks did not move, the drop in your rank tracker was most likely a poisoned page.
6. Ask your rank tracker how it checks. Does it compare pages with history before storing them? Does it re-fetch pages that fail? Does it repair bad days? If the answer is “we store what Google returns”, every one-day drop in your data is suspect.

For more on the wider causes of ranking noise, see why search engine rankings can be inaccurate and how to track SERP volatility.

What to do in Nightwatch

If a day in your Nightwatch data still looks wrong:

• Refresh the keyword. Select it in the keyword table and refresh. This fetches a new page through a different session, which most likely fixes it.
• Report it. Use Report inaccuracy from the keyword’s actions menu. Reports go straight to our team, and every report helps us tune the checks above.

Where this leaves us

Google has not said how long this will last, and each step so far has been followed by another. We expect more. What we can promise is the process: we measure every step on our own data, we check every page against its history before you see it, and we repair what slips through.

A sudden ranking drop is not always a real change in your SEO performance. If a day looks strange, run the checklist above before you act.

If you want daily rank tracking you can trust, start a free Nightwatch trial or book a demo and we will walk you through how we check your data.