Ray Grieselhuber, founder and chief executive of the search data company DemandSphere, today linked five blog posts published between August 27 and October 7, 2026 under a LinkedIn post stating that "the news is finally breaking about problems in SERP / rank tracking across the industry." Read together, the posts describe a summer in which a proxy network was seized, Google wrapped its result links in redirects, blocking intensified from around September 11, and Google began returning what DemandSphere calls spurious results on roughly 11% of the search pages it collects each day.

In Short

Companies that check where websites rank on Google do it by loading Google's results pages automatically, millions of times a day, and since July Google has made that much harder and in some cases has quietly fed those automated visitors wrong results. This matters to every marketer and agency whose reports on rankings, visibility or competitors come from those tools, because some of the numbers produced in September and early October 2026 may describe pages that real searchers never saw. DemandSphere's response is a new feature that reports error and sampling rates alongside the ranking data, so customers can see how much of their data is reliable on a given day.

Five posts, one argument

The LinkedIn post, published on October 12, is short. It lists five links: "Google's Summer of Love," DemandSphere's response "by adding even more transparency to our data," a post titled "Spurious data in Google SERPs," the post on "the massive uptick in AIOs for branded queries," and, in a follow-up line, "our response to Google's goto redirects way back in August."

Four of those five posts were supplied as source documents for this article. The fifth, the spurious data post dated October 7, was not, and its contents are described here from the version published on DemandSphere's website.

DemandSphere is not a neutral observer. It sells rank tracking and AI search visibility data, its platform depends on collecting Google results at scale, and every figure below comes from its own systems unless stated otherwise. According to Grieselhuber's LinkedIn profile, he has led the company since May 2010, when it went through Y Combinator's summer 2010 batch, and it works with more than 500 AI search teams, in-house and at agencies. The company is operated by Ginzamarkets, Inc., and in April 2026 it published a free public log of 173 Google updates stretching back to 2000, which PPC Land covered when it was released. That tracker is referenced in all four posts.

The central claim sits in the September 24 post. "I've been working in this space for 20+ years and the stretch since early September has been the worst that we have seen in terms of challenges to acquire this data," Grieselhuber wrote. His explanation is equally direct: "Google does not want the AI labs to use their SERPs as part of their live retrieval process to answer questions."

July: a proxy network disappears

Rank trackers and scraping APIs do not query Google from a single data centre. They route requests through pools of consumer IP addresses, known as a residential proxy network, so that automated traffic looks like ordinary home users. When one of those pools vanishes, capacity vanishes with it.

According to Grieselhuber, things were quiet until early July, when "the FBI / DOJ appeared to have worked with Google to seize the proxy network of NetNut, one of the largest IP networks in the world, amid allegations that NetNut had built a 'botnet,' which is a very serious allegation to make." He added that "Google's Threat Intelligence Group put the figure at around two million devices; the parent company disputes the allegations."

He was openly skeptical. "Whether or not they were doing such a thing is outside of my purview but I am skeptical. Rather, my guess is that this is simply the framing that was adopted in order to mobilize law enforcement. Again, this is all just my own speculation." The practical consequence, by his account, was the removal of "a large provider from the global network of proxies, which affects everyone in the space," and DemandSphere spent July routing around the gap.

Contemporaneous reporting supports most of that account and differs on two details. Google published its disruption on July 2, 2026. The Hacker News reported the same day that Google's Threat Intelligence Group estimated NetNut controlled at least 2 million devices and had counted 316 threat clusters using suspected NetNut exit nodes in a single week in June. Infosecurity Magazine, on July 3, named the FBI and Google as leading the operation, with Lumen Technologies, the Shadowserver Foundation and IRS Criminal Investigation as partners. Proxyway reported that netnut.com, proxyjet.io and divinetworks.com were seized on July 2, with netnut.io and alarum.io following on July 7.

The first difference concerns the Department of Justice. None of the reports reviewed for this article names it; they name the FBI and the IRS. The second concerns the parent company's position. Alarum, the Nasdaq-listed Israeli company linked to NetNut, initially rejected the botnet label, according to The Hacker News, which described the company calling the research "demonstrably inaccurate assertions and flawed deductions." Its later statement, carried by several outlets, said it "takes this matter seriously and will fully cooperate with law enforcement." Grieselhuber's description of a dispute matches the first position, not the second. Researchers at Qurium, Synthient, Nokia Deepfield and Spur had tied a botnet called Popa to NetNut in June, and Synthient reported that none of the more than 20 apps it examined showed users a consent prompt.

The same research thread surfaced elsewhere in the ad market. In August, Samsung banned residential proxy SDKs from its Tizen TV platform after Spur measured that more than a quarter of Tizen apps carried similar code.

August: the goto redirects

The second disruption was visible to anyone who looked closely at a results page. According to DemandSphere's August 27 post, Google confirmed on August 26 "that it is rolling out google.com/goto redirects on organic search result links." A result that once pointed directly at a landing page "now points at google.com/goto?url=[hash] within the SERP, which then passes the click through to the proper landing page URL." DemandSphere added that it was seeing the wrappers in SERP features as well.

Google's statement, quoted in the post, read: "We have a long history of deploying technical measures against evolving forms of abuse, and we regularly take steps to protect our services and users." Grieselhuber's response was that "this definition of 'abuse'" was "very unilaterally defined and not at all an accurate reflection of what has been repeatedly settled in the courts (in the US)."

The post listed what breaks when a tool reads a goto link as the destination without resolving it:

  • destination URLs that all resolve to google.com
  • domain matching that fails, "so your own pages stop being recognized as yours"
  • share of voice and competitor attribution calculated against the wrong domains
  • historical series that break on the rollout date

DemandSphere said organic ranking data was unaffected, that countermeasures for SERP feature URLs were rolling out, and that metrics including Share of Voice and Unified Visibility continued to work. In the September 24 post, Grieselhuber said the fix took "a matter of hours," because the company already had the infrastructure in place "due to the fact that we needed it for other engines."

Other vendors described a more expensive problem. Nozzle chief executive Derek Perkins told PPC Land that resolving every link on a single five-page ranking takes 500 to 1,000 requests, because the goto links cannot be decoded locally and HEAD requests are refused. SISTRIX told customers on August 31 that it was resolving each link to its real target at one extra server request per URL, while SerpApi said on September 5 that it had deployed a fix restoring direct URLs.

There is one timing discrepancy. The graphic at the top of DemandSphere's August 27 post labels the redirects "in testing since July." PPC Land's reporting traces the first public sighting to Alex Greenland on June 23, 2026, and Perkins said Nozzle had seen intermittent testing for about four months before the August rollout.

DemandSphere framed the goto links as the latest in a series. "Google removed the num=100 parameter last September. Before that, JavaScript gating in the January SERPocalypse," the August post said. Both changes are on PPC Land's record: Google began requiring JavaScript for search in January 2025, and on September 14, 2025 it dropped the num=100 parameter, forcing tools to make ten requests where one had returned 100 results. In the scramble that followed, DemandSphere was one of several platforms that warned customers they might notice fluctuations in ranking reports while it added pagination support.

September: the "ban hammer"

The third phase is the one Grieselhuber considers permanent. "Right around September 11th, Google deployed the most aggressive blocking that we have seen to date. This continued through the weekend and has continued since then," he wrote on September 24. "The blocking operation is still ongoing as of this writing and it represents, I believe, the new reality going forward."

He declined to describe the countermeasures. "Operational playbooks that were in place for 5+ years had to be rewritten," he wrote, but sharing specifics "can cause more damage to our customers." The post said DemandSphere, "along with many of the other vendors in our space," had adopted vague public messaging with more direct communication to customers, and that the company would keep posting updates on its status dashboard.

That silence is part of the story. Grieselhuber noted that a large outage usually ends up "on the front page of Search Engine Land and everybody starts asking (as they have been for 20 years) if 'the rank trackers are finally dead.' (As always, the answer is no.)" This time, he wrote, "everyone became a little more quiet, including ourselves."

The public record now places the problem in a slightly later window. Search Engine Roundtable's Barry Schwartz wrote on October 12 that third-party trackers had struggled since late September 2026. Glenn Gabe posted on September 18 about discrepancies between trackers. Ranktracker, according to a summary by SEO consultant Dalin de Graff published October 11, noticed unusual results around September 17, tested more than 20 competing platforms, found incomplete collection across them and restored its own tracking on October 1. DemandSphere's September 11 start date is the earliest of these, and the only one in the source documents. None of the outside reports cites a Google statement about the September changes.

The window also overlaps an unrelated event that would have moved rankings on its own. Google's September 2026 spam update began on September 24 and was completed on October 8, after 13 days and 16 hours. Ranking volatility caused by a genuine update and ranking noise caused by blocked or poisoned collection would look similar on a dashboard for those two weeks.

October: spurious results

The October 7 post moved from blocking to something harder to detect. According to DemandSphere, Google "has started returning spurious results when it detects suspected bot traffic," and the issue affects about 11% of the company's daily SERPs on current measurements. The post warned that the figure could change quickly and did not describe how it was measured. It cited two posts on X: Charles Floate on September 28, speculating that rank trackers were diverging from real results after a court ruling, and Shoichi Hasegawa on October 1, saying Ahrefs numbers did not appear to match reality.

Nozzle's own analysis, cited by Search Engine Roundtable on October 12, put the share of poisoned results pages at 8.0%. Perkins described wide IP blocking aimed at major residential proxy networks, more CAPTCHA challenges, and the injection of swapped results into suspect pages, with social sites and forums filling the gaps and tracked sites dropping out of the top ten. Nozzle said blocking came first and poisoning second, which matches DemandSphere's sequence.

The two vendors therefore agree on the mechanism and roughly on scale, at 8.0% and about 11%, while measuring different keyword sets with undisclosed methods. Neither figure has been confirmed by Google, which has not commented publicly on either. Search Engine Roundtable named SISTRIX, DataForSEO, SE Ranking, Advanced Web Ranking and Morningscore as having posted support notes, status updates or blog posts about missing or mismatched data, and cited Gabe's observation that Ahrefs had picked up a recovery while Semrush lagged.

Poisoned data is a different kind of failure from blocked data. A blocked request produces a gap, which a vendor can see and flag. A spurious page looks normal and produces a confident number. A brand that appears to drop out of the top ten for a high-value query, while a forum thread takes its place, might be looking at a real ranking change, at the spam update, or at a page Google served only to a suspected bot.

Observability: data about the data

DemandSphere's answer, published on October 6, is a platform feature it calls Observability. Grieselhuber borrowed the term from IT operations, where it covers logs, metrics and traces, and added a distinction of his own. "First-order is the data that everybody pays for: SERP data, LLM data, etc." Second-order data is "the data about this data," such as error rates and sampling rates.

"In a perfect world, there wouldn't be a need for much second-order data about the first-order data but, as of October 2026, we're in a new world," he wrote. He also acknowledged the cost: "This does add a large new burden on platform vendors that did not exist before."

The first version is built around a pattern DemandSphere calls "drop-and-pops," or DnPs. According to the post, "A drop-and-pop occurs when Google temporarily tanks a given domain's rankings for a few days and then brings them back to where they were." Clients started noticing more of them in May, the company said, and it set a rolling seven-day window to separate temporary drops from lasting losses.

What the REI demo shows

The post illustrated the feature with data for REI, which it described as "not yet a client" and a domain DemandSphere uses for demos. The keyword set is modest, and the results are calmer than the surrounding narrative.

In the top three positions, 1,059 keywords representing 9,592,500 monthly searches were classified 99.8% stable by volume. Positions four to ten held 469 keywords and 1,842,280 monthly searches, 99.3% stable. Positions 11 to 20 held 75 keywords and 327,350 searches, 99.9% stable. The classification rules are specific: "Eroded" means a keyword still ranks but its median position fell by ten or more places; "Lost (recovered)" means it had a non-ranking episode of eight days or more but ended the period ranking; "Lost (unresolved)" means it ended the period non-ranking for at least eight consecutive days.

Monthly drop-and-pop prevalence, the share of keywords inside a temporary drop, peaked in May. Weighted by keyword count across all primary tiers, it was 1.8% in April, 3.4% in May, 2.7% in June, 2.4% in July, 0.9% in August and 1.7% in September. Weighted by search volume, the series ran 0.7%, 1.2%, 1.7%, 2.5%, 1.2% and 0.9%. The lower tiers were noisier: in positions 11 to 20, count-weighted prevalence reached 9.6% in May.

Position trends were nearly flat. The top-three tier moved +0.04 positions per week, positions four to ten -0.04, positions 11 to 20 -0.16, and a smaller tier of 26 keywords in positions 21 to 50 moved -0.10. The dashboard's own guidance reads: "Damage concentrated in the premium tier, with the Top 1-3 trend pointing up, is genuine trouble; similar trends across every tier is tracker noise."

The confirmed-loss table is headed by "day packing," with 2,900 monthly searches and a baseline median position of 1.0, classified as lost and unresolved. Most of the other losses listed carry 210, 30 or zero monthly searches, including queries about bicycle sizes for children and plug types in Africa. For this domain, at least, the tool shows small losses on low-volume queries rather than broad damage.

DemandSphere said it would add metrics the same week covering "the spurious results rate and also the overall sampling percentage, along with details around which keywords have sampled data on a day-to-day basis." The October 7 post confirms the company is sampling some sub-pages rather than collecting every page daily.

No other vendor appears to publish comparable error and sampling statistics. Grieselhuber said as much: "there isn't much out there from vendors such as DemandSphere (or anyone in our market) providing answers to these questions as a part of their offering."

Branded AI Overviews, measured in the same month

The October 1 post is the least connected to the data acquisition story and, measured by outside pickup, the most widely cited. According to DemandSphere, AI Overviews on branded queries "more than tripled in the month of September."

The daily series shows presence on tracked branded keywords at 26.12% on September 1, between roughly 27% and 35% for most of the month, then 69.21% on September 26, 90.48% on September 27, 80.23% on September 28 and 82.06% on September 29. The September 29 reading is 3.1 times the September 1 reading. DemandSphere counted an AI Overview as present "regardless of whether brand itself is cited in the AIO," measured each keyword once a day "all markets, all devices," and said Google "has not made any announcements on this change."

Outside observation points the same way. Chris Long, co-founder of Nectiv, found AI Overviews for 93 of 100 enterprise brands he tested using SerpApi, according to Search Engine Land, which reported DemandSphere's series on October 1 and noted that the two datasets are not directly comparable. Schwartz, checking brands manually on September 30, found that most of the branded AI Overviews appeared mid-page or lower rather than at the top, with Adobe an exception, and that Google's own name and news publications did not appear to trigger them. That placement matters, because an Ahrefs study of 10 million results pages in July 2025 found that only 8.64% of AI Overviews appeared outside the top position.

The DemandSphere series also contains swings that the post does not explain. Presence jumped to 57.43% on September 18 and fell to 31.15% the next day; it read 46.62% on September 20 and 28.59% on September 21; it was 55.81% on September 24 and 29.98% on September 25. The data was collected through the same pipeline that, according to DemandSphere's own posts, was under the heaviest blocking in the company's history from September 11 and was receiving spurious pages by early October. The posts do not address whether that affected the AI Overview counts. The later, sustained readings above 69% from September 26 align with Long's and Schwartz's independent checks; the earlier one-day spikes have no outside corroboration.

None of the sources measured clicks. PPC Land has reported Seer Interactive data showing organic click-through rate on queries with AI Overviews falling 61% between June 2024 and September 2025, but that study covered informational queries, not brand searches, and its findings cannot be transferred to branded traffic without new measurement.

Who Google is aiming at

Grieselhuber argued that rank trackers are collateral damage. "Google doesn't care about tools in the AI search / SEO space. Companies in our industry are barely a blip on their radar. The activities of the other AI companies (OpenAI, Anthropic, etc.) are what worry them." Google, he wrote, views those companies "as stealing their data and repurposing it for their own profits, while not giving proper traffic and attribution to the source." His next line was two words: "Ironies abound."

Schwartz reached a similar conclusion on October 12, describing it as his assumption that Google's efforts were aimed at AI bots and SerpApi rather than SEO tools. Nobody at Google has said so.

The legal context is less settled than the September 24 post suggests. Grieselhuber wrote that "all of Google's legal challenges to this have fallen flat." Google did lose the first round of its DMCA case against SerpApi: on July 20, 2026, Chief Judge Yvonne Gonzalez Rogers dismissed Google's complaint, though with leave to amend the claims tied to licensed content. Google filed an amended complaint built on Reddit licensing terms on August 10. According to the court docket in Case No. 4:25-cv-10826-YGR, the judge denied SerpApi's motion to compel production of Google's licensing agreements on September 15, the briefing on SerpApi's motion to dismiss the amended complaint closed with SerpApi's reply on September 29, and a hearing on that motion was set for October 13, 2026. The case is live, and the Reddit suit against SerpApi, Oxylabs, AWMProxy and Perplexity, filed in October 2025, is separate.

Behind the commercial argument sits a philosophical one. "Our view is simple: if there is data about you, or data that affects you, it belongs to you," Grieselhuber wrote. "If the originators of that data won't find a way to provide it, even on reasonable commercial terms, then a market will exist to provide it." It is a position a data vendor has obvious reasons to hold. It is also one that Google's own reporting tools do little to undercut: the AI search report Google added to Search Console in late August shows impressions without clicks or queries, leaving third-party collection as the main source of query-level visibility data for AI features.

Grieselhuber also expects more. "We have a pretty good idea of the sorts of things they will do next and, indeed, are already starting to see hints of it," he wrote, without saying what they are.

Why this matters for marketers

Rank tracking sits underneath a large share of search reporting. Share of voice dashboards, competitor benchmarks, AI Overview citation tracking and agency performance decks are all assembled from automated collection of Google's results pages. Each disruption since January 2025 has raised the cost of that collection. The goto links multiplied request volumes, and the num=100 removal had done the same a year earlier.

What changed in September 2026 is that the cost is no longer only financial. A result page served to a suspected bot, with swapped listings, produces numbers that look valid. According to DemandSphere, that applied to about 11% of its daily pages in early October; according to Nozzle, 8.0%. Neither company has published a list of affected dates, and both say their figures are moving.

For anyone comparing September and October 2026 against earlier periods, three things overlapped: Google's spam update from September 24 to October 8, the sharp late-September rise in branded AI Overviews, and the collection problems documented by at least seven vendors. Separating them requires data about how each number was collected, which is the gap DemandSphere's Observability feature is designed to fill and which most vendors do not yet publish.

Timeline

Summary

Who: Ray Grieselhuber, founder and chief executive of DemandSphere, a rank tracking and AI search visibility vendor operated by Ginzamarkets, Inc.; Google, whose countermeasures the posts describe; and other vendors including Nozzle, SISTRIX, SerpApi and Ranktracker that reported related problems.

What: In five posts linked today on LinkedIn, DemandSphere described the July seizure of the NetNut proxy network, Google's August goto redirects, intensified blocking from around September 11, spurious Google results on about 11% of its daily SERPs, a new Observability feature reporting error and sampling rates, and a rise in AI Overviews on branded queries from 26.12% to 82.06% during September.

When: The posts were published on August 27, September 24, October 1, October 6 and October 7, 2026, and linked together on October 12, 2026. The events they describe run from early July to early October 2026.

Where: Google Search worldwide, as collected by DemandSphere across all markets and devices; Grieselhuber is based in Columbus, Ohio.

Why: Grieselhuber argues that Google is trying to stop AI companies from using its results pages for live retrieval, and that SEO tools are caught in the crossfire. The consequence for marketers is that ranking, share of voice and AI Overview data from September and October 2026 may include pages Google served only to suspected bots, and few vendors disclose how much.