SearchTides Research
The script.google.com Spam Wave: How Google Apps Script Pages Took Over Google's Own Results
Google Apps Script pages ranking on Google's own domain · Ahrefs (keywords updated Sep 25 - Oct 13, 2026) · our live check on DataForSEO, October 15, 2026
Google's spam updates are meant to clear junk out of search. This autumn the biggest winner of two of them was Google itself. Spam pages hosted for free on Google Apps Script, at script.google.com, climbed from about 32,000 visits a month to more than 50 million, ranked #1 for some of the most-searched adult terms on the planet, and were quoted thousands of times by Google's own AI Overviews and AI Mode. Google saw a tidy SEO article; visitors were sent straight to casino and AI-porn affiliate offers. Then, sometime in mid-October, they vanished from the results.
Organic traffic
32K → 51.0M
Ahrefs monthly average, August to October 2026
Ranking pages
559 → 33K
on script.google.com, August to October
AI answers citing it
5K vs 1
Google AI Mode responses vs ChatGPT
Ranking today
0 of 300
top keywords, checked twice each, Oct 15
Source: Ahrefs Site Explorer, script.google.com, monthly averages. Dashed lines mark Google's August 18 and September 24 spam updates.
Key findings
- It grew with Google's spam updates, not against them. Ahrefs shows script.google.com going from about 32,000 monthly organic visits and 559 ranking pages in August to 51.0 million visits and about 33,000 pages in October. The climb started around the August 18 spam update and steepened sharply after the September 24 spam update.
- It is overwhelmingly adult content aimed at Egypt. At least 92% of the traffic in Ahrefs' top 1,000 keywords comes from adult searches. Egypt alone accounts for 78% of it, and Arabic-language searches for 79%. "xxx" in Egypt was ranked #1 with an estimated 16 million visits on its own.
- The rest is cheap, high-volume navigation. Instagram story viewers, Omegle, platform names (Instagram, LinkedIn, DeviantArt, Priceline) and a few Indian government status checks. Examples: instagram story viewer, instagram, annapurna bhandar status check, omegle, deviantart, insta story viewer, linkedin, omegle, dinotibe, priceline.
- It ranked at the very top. 569 of the 1,000 keywords had script.google.com at #1, across 85 countries.
- Google's own AI repeated it; ChatGPT didn't. Ahrefs counts 12.1K AI Overview responses (5.5K pages), 5K AI Mode responses (3.5K pages) and 2K Gemini responses citing script.google.com, against 93 for Copilot, 39 for Perplexity and exactly 1 for ChatGPT. The spam reached people through Google's index; tools that rely on other search indexes barely saw it.
- As of October 15, it no longer ranks. We checked Ahrefs' top 300 keywords by traffic in their own country and language, twice each on desktop and the top 30 on mobile: script.google.com appeared in none of 572 result pages (281 keywords with results). The pages themselves are still online.
What ranked
| Type of keyword | Keywords | Share of traffic |
|---|---|---|
| Adult | 457 | 92.2% |
| Social media tools and platform names | 217 | 5.1% |
| Everything else (status checks, brands, health, tools) | 326 | 2.8% |
| Country | Keywords | Share of traffic |
|---|---|---|
| Egypt | 43 | 78.0% |
| Iraq | 16 | 5.4% |
| India | 173 | 3.2% |
| Turkey | 23 | 1.9% |
| Thailand | 21 | 1.3% |
| United States | 105 | 1.0% |
| Nigeria | 12 | 0.8% |
| Russian Federation | 5 | 0.7% |
| Indonesia | 134 | 0.7% |
| Pakistan | 36 | 0.6% |
Share of the estimated organic traffic in Ahrefs' export of script.google.com's top 1,000 organic keywords.
How it works
- Free hosting on Google's own domain. Google Apps Script lets anyone publish a small web app at script.google.com/macros/s/<script id>/exec. The page inherits the trust of a domain rated DR 100 and there is no spam domain of the spammer's own for Google to penalize.
- One script, unlimited pages. 93% of the ranking URLs carry a query parameter (?id=<keyword slug>), so a single script generates a page per keyword. 476 different scripts sit behind the 1,000 keywords.
- Google sees an article, people see an offer. The pages show Google a long, keyword-rich SEO article, while real visitors are redirected straight to affiliate offers, usually online casinos or AI porn sites. Showing search engines different content from people (cloaking) and sneaky redirects are both named violations of Google's spam policies, on Google's own domain.
- Even the redirect runs on Google. Opening one of the top URLs first bounces to script.googleusercontent.com, another Google-owned domain, before the visitor reaches the offer.
- Pushed with links. Ahrefs shows referring domains to script.google.com up 10.9K to 51.1K and backlinks up 365K to 8.8M over the same period, the pattern of a link-spam campaign aimed at the new pages.
Timeline
- Aug 18, 2026Google spam update. script.google.com starts gaining rankings from about 32K visits and 559 pages.
- Sep 20, 2026Google starts poisoning results served to scrapers (Nozzle research), which affects rank trackers including Ahrefs and DataForSEO.
- Sep 24, 2026Google spam update. Growth accelerates sharply.
- October 2026Peak: 51.0M average monthly organic traffic and about 33K ranking pages in Ahrefs. Ahrefs' current-day estimate already shows 26.3M.
- Oct 13, 2026Latest Ahrefs update on these keywords.
- Oct 15, 2026Our check: none of the top 300 keywords show script.google.com in the top 20.
Why we think it has been closed
- Zero, not fewer. Not one script.google.com result in any successful lookup, desktop or mobile, for keywords where Ahrefs had it at #1 days earlier. Partial decline would show up as a few survivors; there are none.
- The pages are still live. Seven of the eight biggest script URLs still load and the eighth redirects. Google has stopped ranking them rather than the spammers taking them down, which points to Google acting on the path (script.google.com/macros) as a whole.
- Not fake results on our side. Google's scraper poisoning made 28% of our DataForSEO pulls unreliable at most; it can't hide a site in every one of 572 lookups. And our checker found other Google-owned pages (play.google.com, workspace.google.com) normally.
- Ahrefs' current-day traffic is already half the October average (26.3M against 51.0M), consistent with a drop that Ahrefs' monthly figure hasn't caught up with yet.
Caveats Ahrefs' rankings for these keywords were recorded between Sep 25 and Oct 13, during the poisoning period,
so some of what Ahrefs stored may itself have been fake results. Our check is one day (Oct 15), desktop for all 300 keywords and mobile for
the top 30; DataForSEO doesn't cover Russia, and some adult searches returned no results in some countries. A site: search for the
pages returned nothing usable, so we can't say whether they are out of Google's index or only out of the rankings. We'll re-run the check
in a week or two to confirm it stays closed.