Spammers Are Using Google Apps Script To Rank In Google Search

It looks like spammers have found a new free host for parasite SEO: Google Apps Script.

Parasite SEO means you put your page on someone else's trusted website, so the page borrows that site's ranking power. Here, the trusted website is Google's own script.google.com. And spammers found way to use it to rank their content on high difficulty keywords at scale.

On 4 October 2026, Ahrefs counted 23,377 ranking pages under script.google.com/macros/, with an estimated 68.1M monthly visits. Almost none of the top pages ranked in July. About 80% of that estimated traffic goes to adult keywords. The rest includes "instagram", GLP-1 weight-loss drugs, crypto referral codes and "earn money online".

Many of these pages use cloaking. Google's crawler gets a normal article. A person gets a full-screen offer or a redirect. Google has not made a public statement yet.

What Google Apps Script is, and why spammers like it

Google Apps Script is a free coding tool inside Google Workspace. People use it to automate Sheets, Docs and Gmail. Schools, councils and small businesses also use it to build small web tools, such as forms and trackers.

Sample of Google App Script page that looks like a full website with the App Script banner at the top

Any Apps Script project can be published as a web app. The script needs a function called doGet that returns a page. Google then gives the app a public address like this:

https://script.google.com/macros/s/<long-ID>/exec

The /exec address is the live, public version. Anyone can open it, and Google can crawl it.

The page sits inside a Google sandbox

Apps Script does not serve your HTML directly. Google sends a wrapper page first. The wrapper holds your HTML as a long text string. Google's JavaScript then draws that HTML into an iframe, which is a page shown inside another page. That iframe runs on a separate Google sandbox host (*.googleusercontent.com), so the app cannot harm the main domain.

Three things follow from this design.

• The page title is the only head element the author controls. Meta descriptions in the HTML are ignored.

• A crawler that does not run JavaScript sees only the title. Google renders JavaScript, so Google sees the full text. Most LLMs like ChatGPT & Claude do not.

• Every visitor sees a grey Google banner: "This application was created by a Google Apps Script user", with a "Report abuse" link.

Why the domain is attractive

The page lives on Google's own domain. In search results, Google shows the site name "Google" and the Google "G" icon next to these pages.

Example of a company ranking for the term 'semaglutide dosing' with a Google App Script page

The pages also rank without links. In the Ahrefs export, almost every top page has a UR (Ahrefs URL Rating, a link-strength score) of 0. Only 7 of the top 1,000 pages have any referring domain. Four of those seven are real apps.

So the spammer gets free hosting, free compute and Google's domain trust. A new page costs a few minutes. One script can also serve thousands of URLs. It reads a value from the address, such as ?id=, and returns a different page for each value. 534 script IDs produce the top 1,000 URLs. The pages borrow trust from the host itself. That is the core of the parasite play.

The numbers

All figures below come from Ahrefs "Top pages" export for the path script.google.com/macros/, taken on 4 October 2026, unless marked. Ahrefs traffic is a modelled estimate. It multiplies rank, search volume and a click-through model. It is not measured visits.

• 23,377 ranking pages under /macros/. Ahrefs, 4 Oct 2026. A 5 Oct view of all script.google.com shows ~25.1K pages.

• 68.1M estimated monthly visits. Model estimate. Ahrefs showed a SERP-data warning on 29 Sep. 179 top pages show more traffic than their keyword's whole search volume. A 5 Oct view of all script.google.com shows ~72M.

• 998 / 1,000 top pages that did not rank on 4 Jul 2026. The other two are real apps.

• ~80% of top-1,000 traffic goes to adult keywords. 738 pages, 53.4M estimated visits.

• 0.09% of top-1,000 traffic goes to real Apps Script apps. 8 pages, about 60K estimated visits.

• 7 / 1,000 top pages with any referring domain. Median top-keyword position: 2.

Treat the size of the spike with care. Ahrefs put a banner on its data on 29 September: "We're currently seeing changes in how Google serves search results, which may cause inconsistencies in some SERP data." Also, 179 pages, carrying 28.7M of the estimated traffic, show more visits than their top keyword's monthly search volume. That cannot be a real number.The rankings are real, because Ahrefs saw these URLs at positions 1–3. The 68.1M total is not reliable. A safer claim is "tens of millions of estimated visits, from near zero, in about two weeks."

Ahrefs "Top pages" for script.google.com/macros/: 23,377 pages and 68.1M estimated traffic. The chart rises almost vertically at the end of September.

Source: Ahrefs Site Explorer, 4 Oct 2026.

The whole script.google.com host over five years. It stays flat near zero, then spikes to about 25.1K pages and about 72M estimated traffic.

Source: Ahrefs Site Explorer, 5 Oct 2026.

The top rows by traffic are adult video-site brand keywords, mostly for Indonesia, with France and other countries below. "Instagram" in India sits in second place. Every row shows UR 0 and no referring domains.

Source: Ahrefs Site Explorer, 5 Oct 2026.

The markets are mostly Asian and consumer. By estimated traffic, Indonesia is 37% and India is 28% of the export. The US is only 1.1%. US pages sit in the "cleaner-looking" money niches: GLP-1 drugs, AI tool reviews, phone lookup and social-media tools.

One more contrast helps. A researcher sampled 250 working Apps Script pages from 2026 Wayback Machine captures. Only 2 were spam. The rest were school, government and hobby tools. So most public Apps Script apps are real. But almost all Apps Script pages that get Google traffic are spam.

Five pages we found in Google, and how they earn

The adult networks hold most of the traffic. But the commercial pages are the ones that SEOs and marketers will meet in their own search results. So we start there.

We searched these queries in Google on 5 October 2026, from Singapore. We fetched each result twice on the same day. One request used a normal Chrome user agent. The other used the Googlebot user agent. A user agent is the short text that a browser or crawler sends to say what it is.

Limits of the "Googlebot" view

Our Googlebot requests came from non-Google IP addresses. A cloak that checks the IP address would treat them as people. So "what Googlebot gets" means "what a request with a Googlebot user agent gets". Real Googlebot could get something different. We did not click any offer link.

In the SERP screenshots, the DR, UR and keyword numbers under each result come from an SEO browser toolbar. They are not part of Google's page.

1. "free gemini api key": a tutorial with a survey button

Google results for "free gemini api key". The Apps Script page ranks #2, between Google AI Studio and Google's own Gemini API docs. The snippet says "2 hours ago".

Source: Google Search, 5 Oct 2026.

• What it is: A 1,650-word guide, "How to Get a Gemini API Key Free: Complete Guide for Beginners". The steps follow Google's real instructions.

• How it earns: One big button, "Get 100% Free Gemini API Key — Instant Access", links to globalinterndesk.com/ecc/gemini. The link has no "sponsored" or "nofollow" label. A real Gemini key comes from Google AI Studio, so the promise is false.

• Operator clues: The "Updated at" date changes on every request. The script exposes a function called getUpdatedDate. The same globalinterndesk.com/ecc/ link pattern appears on at least six other scripts, including example 3. The tracker domain was registered on 24 Dec 2025.

• Structure: One script serves four guides through ?slug=. An unknown slug returns a "Page Not Found" page with status 200 and "index, follow", which is a soft 404.

• Ahrefs: This slug ranks for "gemini api key" (US, position 6, 8,544 estimated visits). A sister slug ranks for "gemini ai api key" (India, position 9). Both are new since July. Zero AI responses.

• Cloaked?: No. Googlebot and Chrome got the same page.

What a person & GoogleBot gets

Desktop Chrome user agent. The blue button sits right under the intro. Capture: 5 Oct 2026.

Original Page: https://script.google.com/macros/s/AKfycbxEOsmZoI9jnJH_nVTP2YRBitD9Fa5qIfEoMq1w4L9wwD5S8J3n8Lac48Uvc1g2VQbQXQ/exec?slug=how-to-get-a-gemini-api-key-free-complete-guide-for-beginners

2. "bitget referral code": one page, one code

Google results for "bitget referral code". The Apps Script page ranks #2, above Bitget's own help page on referral codes. Google added "- Apps Script" to the title.

Source: Google Search, 5 Oct 2026.

• What it is: A one-page landing page, about 1,000 words, built with Tailwind. A badge says "Verified Official Bitget Referral Code: BGB101". No meta description, no schema, no author.

• How it earns: Affiliate income. An affiliate earns a fee when a person signs up through their link or code. All four buttons link to Bitget's partner domain. A copy button copies "BGB101". This is Bitget's own affiliate programme, so it is not a scam funnel. "Verified Official" is the affiliate's claim, not Bitget's.

• Operator clues: The script has one function, doGet. It is a static page. A different Apps Script page pushes the code "BEST99" for the same query in Australia. Several unrelated affiliates have found the same trick.

• Ahrefs: This page is not in the top 1,000. The BEST99 page is: "bitget referral code", Australia, position 3, 3,163 estimated visits. A Gate.io sign-up bonus page ranks #3 in Germany.

• Cloaked?: No.

What a person & GoogleBot gets

Desktop Chrome user agent: the "Bitget Bonus Hub" page with the BGB101 code box. Capture: 5 Oct 2026.

Original Page: https://script.google.com/macros/s/AKfycbzimcptIvtgh7b1tfhs1ppz4KE68YU8nIbOjGnBpXGrjvqVQfFI2-jHKBp6MYUManGY6A/exec

3. "earn money online": an AI article farm at #1

Google results for "earn money online", searched from Singapore. The Apps Script article ranks #1. Its snippet says "3 hours ago". Airtasker is #2.

Source: Google Search, 5 Oct 2026.

• What it is: "How to Make Money Online in Singapore: 15 Legit Ways to Earn", about 1,500 words, with a "Quick Answer" box, FAQ schema and a self-canonical tag. The publish time in the schema is 01:51 UTC that morning.

• How it earns: One banner under the Quick Answer: "Earn $100 easy money by completing 2 surveys. Guaranteed!" It links to globalinterndesk.com/ecc/secret. This is a survey offer. These usually pay per completed sign-up. We did not open it.

• Operator clues: The script exposes 31 server functions, including callOpenAI, generateArticle, buildPrompt, runBatch and exportAllUrlsToSheet. The script writes articles with OpenAI's API on a timer, stores them in Drive and serves them from Google. It shares the globalinterndesk.com tracker with example 1.

• Structure: ?p=sitemap returns a real XML sitemap with 239 articles. Slugs target many countries: India, the US, the UK, Germany, Singapore, Nigeria and more.

• Ahrefs: This script is not in the top 1,000. A sister page with the same tracker, "20 Game Apps That Pay Real Money", is. It has 216 AI responses, the most in the export. See AI answers.

• Cloaked?: No. Only the random "Related Guides" list changed between fetches.

An article published that morning holds #1 for an 11K-volume query that the toolbar rates at KD 70. That shows how much weight host trust and a fresh date carry here.

What a person & GoogleBot gets

Desktop Chrome user agent. The survey banner sits under the Quick Answer. Capture: 5 Oct 2026.

Original Page: https://script.google.com/macros/s/AKfycbx-XDkfBwyqJTuVEwCUbPSKXXz1mSIEss2a9GB5_uycMjB3QztKGqy-YaJQllI0u_fr/exec?p=how-to-make-money-online-in-singapore-15-legit-ways-to-earn

4. "semaglutide dosing": a medical article for Google, a sales page for people

Google results for "semaglutide dosing". The Apps Script page ranks #5, between Mayo Clinic (#4) and Wegovy.com (#6). It has UR 0 and no backlinks.

Source: Google Search, 5 Oct 2026.

• What it is: "Semaglutide Dosing Guide: Matching Dosage to Your Body Weight Goals", about 1,300 words, signed "Jordan Ellis". We found no evidence that this person exists. The canonical tag points to a site that no longer resolves.

• How it earns: A real browser gets a full-screen iframe of a "TrimRx"-branded GLP-1 sales page on trimrx.bestglprecommend.com. That domain was registered on 20 Aug 2026. All 12 buttons on it go to an affiliate tracker with affiliate ID a=302537.

• Unsafe content: The article's "Do's and Don'ts" list says: "Do: Increase your dose faster than every four weeks without medical supervision" and "Do: Share your medication with others who may have similar health goals." This contradicts the article's own text. Googlebot gets this text.

• Operator clues: Chinese analytics (51.la) on the page. A "not found" message in Chinese on the bare script URL. A Hong Kong registrant on the dead canonical domain. These are signals, not an identity. See Who is doing this.

• Cloaked?: Yes. A script in the page hides the offer from a long list of bots, SEO tools and AI crawlers.

What a person gets

Desktop Chrome user agent. A full-screen GLP-1 offer covers the article. Capture: 5 Oct 2026, headless Chrome with the user agent set on every frame.

What Googlebot gets

Googlebot smartphone user agent. The article only, with no offer. Capture: 5 Oct 2026.

The same script serves at least 23 GLP-1 articles through ?id=. Twenty-two are in the Ahrefs top 1,000. All target US searchers. Several slugs chase the same keyword: six for "glp1 pill" and four for "semaglutide cost".

Ahrefs export, 4 Oct 2026, top 10 of 22 GLP-1 pages on one script by estimated traffic. All US, all new since July, UR 0, 0 AI responses. Full list in the appendix.

With the page in the screenshot, this one script has three pages for "semaglutide dosing". Google ranks a YMYL page next to Mayo Clinic. YMYL ("Your Money or Your Life") is Google's term for topics where bad advice can hurt people, such as health.

Original Page: https://script.google.com/macros/s/AKfycbygB7nHC8BLNa4o5NZzuLMX6WO4ICJViVHDKGosiQ1YWQ8W_V9JLtyn3g3JIE-uYUz01g/exec?id=Semaglutide-Dosing-Guide-Matching-Dosage-to-Your-Body-Weight-Goals

5. "Lycamobile Australia eSIM": a whole crypto shop on Apps Script

Google results for "Lycamobile Australia eSIM". The first result is an Apps Script page in French. Google shows a product rich result: "A$15.06 to A$20.08 · In stock".

Source: Google Search, 5 Oct 2026.

The page behind the result: a "MetaSwap" store page with two eSIM plans and crypto-only payment.

Source: Google App Script, 5 Oct 2026.

• What it is: A full shop called "MetaSwap", built entirely on Apps Script. It sells gift cards, top-ups, eSIMs, prepaid cards, phones and tech. It takes only crypto: "BTC, USDT, ETH, SOL and 20+ more".

• How it earns: Direct sales. The script exposes order functions: quoteCart, createOrder, pollOrders, payOptions and syncSanctions. A footer says MetaSwap is an independent reseller. We did not place an order. It may be a real reseller or a scam.

• Operator clues: No domain of its own. Checkout runs on Google /exec URLs. Support is a Tawk.to live-chat widget. Do not link MetaSwap to any real company with a similar name.

• Scale: The sitemap index lists 32,280 URLs across 208 country codes and 13 languages, with hreflang tags and Product schema on each page.

• Ahrefs: Not in the top 1,000. The toolbar shows volume 0 for this query. This is a long-tail model: many small branded product queries.

• Cloaked?: No.

Here the risk is borrowed trust. A buyer sees "Google" as the site name, a price and "In stock". Behind it is a store with no business identity beyond a chat widget.

What a person gets

Desktop Chrome user agent. Capture: 5 Oct 2026.

What Googlebot gets

Googlebot smartphone user agent. Same store. Capture: 5 Oct 2026.

More commercial keywords on Apps Script

The five pages above are not alone. The Ahrefs top 1,000 holds more pages in money and utility niches. Most are small next to the adult networks. But these are the queries a brand or agency is most likely to compete on.

Ahrefs export, 4 Oct 2026 (top keyword per page; traffic is estimated).

"Cloaked" comes from our fetches on 4–5 Oct 2026. "Not checked" means we did not fetch that page.

The "mic test" page no longer matches its keyword. It now serves an "AI Platform Reviews" hub, and only non-Googlebot visitors get a 1.5-second redirect to a /spy/ path on tradingred.site. The Hostinger page uses the same ?zex= URL style as a large cloaked Instagram network, but it is a plain referral page. The kit is shared or sold, or that operator also does plain affiliate SEO. We cannot tell which.

Where this started: an indexing-tool listicle

We first noticed this through a page in the indexing-tool niche. We searched for "best indexing tool" and saw an Apps Script page in Google. It is titled "Top 3 Best Instant Indexing Tools, Compared" and marked "Updated September 22, 2026".

• It ranks Cheetah Indexer #1, Elbestor's indexing tool #2 and free Google Search Console #3.

• The two paid links carry rel="sponsored" and an affiliate disclosure, but no affiliate parameters.

• Cheetah Indexer's domain was registered on 31 Jul 2026, with WHOIS privacy. Its homepage testimonials are labelled "(placeholder)". Its "URLs submitted" counter read exactly 10,482,915 on two days.

• Cheetah's site does not link to the page. It has no visible affiliate programme.

• The page is not cloaked. Googlebot and Chrome got identical HTML.

Who published it is not proven. Cheetah gets the top slot and the warmest copy, so it is the stronger suspect. An independent affiliate or Elbestor could also be the publisher. Google does not show the owner account of a script. Elbestor itself uses Apps Script as the back end of its paid tool. That is a normal app use, not spam.

This page is not in the Ahrefs top 1,000, so it gets fewer than 1,632 estimated visits. The indexing niche is where SEO people noticed the tactic. It is not where the traffic is.

What Bing shows

We also checked Bing. A site:script.google.com search on Bing returns "757 results". The visible ones are ordinary apps, such as a practice sheet and a personal portfolio. A "best google indexer" search on Bing shows no Apps Script result at all.

Bing, site:script.google.com: about 757 results, mostly ordinary apps.

Source: Bing, 5 Oct 2026.

Bing, "best google indexer": indexing vendors and blogs, with no Apps Script page.

Source: Bing, 5 Oct 2026.

This is two screenshots, not a full comparison. But it fits the technical picture. Google renders the sandbox iframe and ranks these pages. Bing does not appear to give them the same reach.

How to run an honest test

Some SEOs will want to see the effect for themselves. If you do, run one small, honest test. Use the same content for every visitor and every bot. Do not cloak. Do not redirect. Never use it for a client.

Policy first

Google's spam policies judge the content and its purpose, not who owns the host. Content placed on a host mainly to borrow that host's ranking signals matches the intent of site reputation abuse. Many pages made to manipulate rankings is scaled content abuse. Apps Script's terms let Google suspend a script without notice. Keep the test to 1–3 pages.

Steps

1. Make a throwaway account. Create a new consumer Gmail account for this test only. Do not use a work account or any account with Search Console, Ads, client files or payment methods.

2. Make a throwaway target. Use a new test domain or test blog. Never point the test at a client site or your company site.

3. Create the project. Go to script.google.com and click New project. Add an HTML file (Add a file > HTML). Paste one of the scripts below.

4. Test it privately. Click Deploy > Test deployments and open the /dev URL. Only editors can see /dev.

5. Deploy as a web app. Click Deploy > New deployment > Select type > Web app. Set Execute as: Me. Set Who has access: Anyone. Googlebot does not sign in, so "Anyone with Google account" will not work.

6. Copy the /exec URL. For later edits, use Deploy > Manage deployments > Edit > New version. The URL stays the same.

7. Check it like a stranger. Open the URL in a private window. You should see the Google banner and your page.

8. Get it discovered. You cannot verify script.google.com in Search Console. Add one normal link to the /exec URL from a page you own that Google already indexes. Then request indexing for that page. Do not buy indexer services or spam links.

9. Track it. Daily for 14 days, then weekly to day 42:

   • site:script.google.com "an exact sentence from your page" to see if it is indexed;

   • a rank tracker on your target query, with the /exec URL as the tracked URL;

   • UTM-tagged links to your test domain, because the referrer from the sandbox may be missing;

   • the test Gmail inbox, for any suspension or "phishing" notice;

   • curl -sI on the URL, to spot a new X-Robots-Tag: noindex header.

10. Stop rules. Archive the deployment at once if Google flags the script, the account or the test domain. Stop at day 42 in any case. Six weeks is enough to see index speed and lifespan.

Script 1: one honest page

Two files. The script sets the page title. The HTML file holds the content.

Code.gs

// One honest page. Same HTML for every visitor and every bot. No redirects.
function doGet() {
  return HtmlService.createHtmlOutputFromFile('index')        // file "index.html"
    .setTitle('How to Repot a Snake Plant: A Plain Guide')     // the only way to set the page <title>
    .addMetaTag('viewport', 'width=device-width, initial-scale=1'); // allowed meta name
  // XFrameOptionsMode: keep the default. Add
  //   .setXFrameOptionsMode(HtmlService.XFrameOptionsMode.ALLOWALL)
  // only if you must embed this page on another site (it removes clickjacking protection).
}

index.html

<!DOCTYPE html>
<html>
  <head>
    <base target="_top">  <!-- links must leave the sandbox iframe -->
    <!-- <title> and <meta name="description"> here are ignored for the top-level page -->
    <style>body{font-family:system-ui,sans-serif;max-width:720px;margin:2rem auto;padding:0 1rem;line-height:1.6}</style>
  </head>
  <body>
    <h1>How to repot a snake plant</h1>
    <p>Write 600–1,000 words of original, useful text. No hidden text, no keyword lists.</p>
    <h2>What you need</h2>
    <ul><li>A pot 2–5 cm wider than the old one</li><li>Cactus or succulent mix</li></ul>
    <h2>Steps</h2>
    <ol><li>Water lightly the day before.</li><li>…</li></ol>
    <p>More notes on our test site:
      <a href="https://YOUR-TEST-DOMAIN.example/snake-plant?utm_source=apps_script&amp;utm_medium=referral&amp;utm_campaign=gas_test_1"
         target="_top">snake plant care notes</a></p>
  </body>
</html>

Script 2: a small router with an HTML sitemap

This copies the spammers' "one script, many pages" pattern in honest form. Each ?slug= value is a page. The bare URL lists all pages. Keep it to about ten slugs. More becomes scaled content.

Code.gs

// One deployment, many ?slug= pages, plus an HTML sitemap. Same content for everyone. No redirects.
const BASE = 'https://script.google.com/macros/s/PASTE_DEPLOYMENT_ID/exec'; // your /exec URL
const SHEET_ID = ''; // optional: a Sheet whose first tab has a header row: slug | title | h1 | body

const PAGES = {
  'repot-snake-plant': { title: 'How to Repot a Snake Plant', h1: 'Repotting a snake plant',
    body: ['Paragraph one…', 'Paragraph two…'] },
  'water-snake-plant': { title: 'How Often to Water a Snake Plant', h1: 'Watering a snake plant',
    body: ['Paragraph one…'] },
};

function loadPages() {
  if (!SHEET_ID) return PAGES;
  const rows = SpreadsheetApp.openById(SHEET_ID).getSheets()[0].getDataRange().getValues();
  const pages = {};
  rows.slice(1).forEach(function (r) {                       // skip the header row
    if (r[0]) pages[r[0]] = { title: r[1], h1: r[2], body: String(r[3]).split('\n\n') };
  });
  return pages;
}

function doGet(e) {
  const pages = loadPages();
  const slug = (e && e.parameter && e.parameter.slug) || ''; // ?slug=…  (never use c or sid)
  const page = pages[slug];
  const t = HtmlService.createTemplateFromFile(page ? 'page' : 'sitemap');
  t.page = page || null;
  t.home = BASE;
  t.notFound = !!slug && !page;                              // still HTTP 200 (soft 404)
  t.links = Object.keys(pages).map(function (s) {
    return { href: BASE + '?slug=' + encodeURIComponent(s), title: pages[s].title };
  });
  return t.evaluate()
    .setTitle(page ? page.title : 'Snake Plant Guides: All Pages')  // per-page <title>
    .addMetaTag('viewport', 'width=device-width, initial-scale=1');
}

page.html

<!DOCTYPE html>
<html>
  <head><base target="_top"></head>
  <body>
    <h1><?= page.h1 ?></h1>
    <? for (var i = 0; i < page.body.length; i++) { ?>
      <p><?= page.body[i] ?></p>
    <? } ?>
    <p><a href="<?= home ?>">All guides</a></p>
  </body>
</html>

sitemap.html

<!DOCTYPE html>
<html>
  <head><base target="_top"></head>
  <body>
    <h1>All guides</h1>
    <? if (notFound) { ?><p>That page does not exist. Pick one below.</p><? } ?>
    <ul>
      <? for (var i = 0; i < links.length; i++) { ?>
        <li><a href="<?= links[i].href ?>"><?= links[i].title ?></a></li>
      <? } ?>
    </ul>
  </body>
</html>

We checked both scripts by hand against Google's Apps Script docs (read 5 Oct 2026). We did not run them. Test on the /dev URL first. <?= ?> escapes its output, so Sheet text shows as text. Use /exec/your-slug with e.pathInfo if you prefer path URLs. We do not know if Google treats the two styles differently.

Limits you will hit

• No meta description. Only the title and four allowed meta names (viewport, google-site-verification and two mobile-app tags) reach the top-level page. No robots meta, canonical or hreflang. HtmlOutput docs.

• The body needs JavaScript rendering. The raw /exec HTML holds the title. The body is an escaped string that Google's script draws into the sandbox iframe.

• No Search Console. You cannot verify the host, so you get no indexing reports, no manual-action notices and no removals tool.

• No status codes. Every response is HTTP 200. Unknown slugs become soft 404s.

• Quotas. A consumer account can create 50 projects a day, run 30 executions at once and make 20,000 URL fetches a day. A test page will not hit these. Quotas.

• The banner. Every visitor sees "This application was created by a Google Apps Script user" and a "Report abuse" link. Expect lower trust and fewer clicks.

• No automatic redirects. The sandbox blocks top-level navigation. Links must use target="_top" or _blank. Restrictions.

• Account risk. Google can suspend the script without notice. Security tools already flag many /exec URLs because of phishing.

Cloaking: how Google and people see different pages

Cloaking means you show search engines different content from what people see. Google lists it as a spam violation in its spam policies. On Apps Script, the usual goal is simple. Google gets a clean article that can rank. A person gets an offer.

One page, four views

The semaglutide page from example 4 shows the full chain.

The searcher sees an Apps Script result at #5 for "semaglutide dosing", next to Mayo Clinic. Google, 5 Oct 2026.

Googlebot gets a medical-style article. Its "Do's" list includes "Do: Share your medication with others." Googlebot UA capture, 5 Oct 2026.

A person who clicks gets a full-screen GLP-1 offer under the Apps Script banner. 5 Oct 2026.

The framed page on its own domain. Every button goes to an affiliate tracker with ID a=302537. Direct capture, 5 Oct 2026.

The raw HTML is the same for both user agents. The switch happens in the browser. A short script in the page head checks the visitor. If the visitor looks like a real person, the script adds a full-screen iframe of the offer on top of the article. Here is the logic, simplified:

Pseudocode, simplified from the GLP-1 page (not working code)

if browser reports automation (navigator.webdriver): stop
if user agent matches /bot|crawl|spider|google|bing|ahrefs|semrush|chatgpt|openai|perplexity|claude|…/: stop
if user agent is not a normal desktop or mobile browser: stop
add full-screen iframe → hxxps://trimrx.bestglprecommend[.]com/   // covers the article

Note the bot list. It names SEO tools and four AI crawler words: chatgpt, openai, perplexity and claude. This operator expects AI engines to fetch the page and hides the offer from them.

A first try with a plain headless screenshot did not trigger this cloak. Our researcher had to set the user agent on every frame, including the sandbox iframe, and hide the automation flag. Simple tools can miss this kind of cloak.

The techniques we found

Fetched and decoded 4–5 Oct 2026. We read the code. We did not run it, and we did not open adult or scam destinations.

The server-side check, simplified

Apps Script's doGet(e) event has no request headers. But Google documents a separate call, HtmlService.getUserAgent(), that returns the user agent inside doGet. The pages echo the user agent with a ,gzip(gfe) suffix that Google's front-end servers add, so the value comes from the server.

Pseudocode, simplified (not working code)

ua = HtmlService.getUserAgent()
SPAM_DETECTED = ua contains "googlebot" (any case)
page = article
if not SPAM_DETECTED: page += "after 1.5 s, replace location with OFFER"
return page

We sent this page 18 different user agents. Only the two real Googlebot strings and a lowercase "googlebot" got the clean article. Bingbot, AhrefsBot, SemrushBot, GPTBot, ClaudeBot, PerplexityBot, curl and Safari all got the redirect. So did Google-InspectionTool and GoogleOther.

One obfuscated loader, decoded

The Instagram and Facebook network loads small scripts from trackerapps.website and trackerleads.website. They are packed to look like noise. The start of one file looks like this (truncated):

Obfuscated file, first 2 lines only (truncated)

(function(){var xQv='',SlA=854-843;function gQI(i){var g=7380163;var y=i.length;
var c=[];for(var e=0;e<y;e++){c[e]=i.charAt(e)};for(var e=0;e<y;e++){var m=g*(e+168) …

Our researcher decoded it offline, without running it. There are three layers:

1. A string shuffle. A fixed-seed function swaps the letters of each text string back into order.

2. A hidden function builder. One shuffled string spells "constructor". This gives the code JavaScript's Function builder without naming it, and it builds a second decoder.

3. A word-substitution packer. The second decoder rebuilds the final code from a word list and placeholder characters.

All three layers hide one line:

Decoded logic (destination defanged)

if user agent does not include "Googlebot": go to hxxps://newp11[.]com/priv/

Sister files use the same packer with other paths, per brand and language. The redirect domains were registered on 2 Sep and 22 Sep 2026. WHOIS.

How to spot a cloaked Apps Script page

1. Run Google's Rich Results Test or the URL Inspection live test. These tools crawl as Google-InspectionTool. That user agent does not contain "Googlebot". So the "Googlebot-only" cloaks fire, and the tool's screenshot shows the redirect or offer. The operator's own cloak gives it away.

2. Read the function names. Every /exec page lists its server functions in plain text in the wrapper, in a functionNames field. Names like injectDelayedRedirect, authorizeDrive or extractTitle point to spam. Real apps show real verbs, or just doGet. See the appendix table.

3. Fetch twice and compare. Fetch the URL with a Googlebot user agent and with a browser user agent. Decode the userHtml string inside goog.script.init(…). A difference in one script block means a server-side cloak. Identical HTML can still hide a client-side cloak, because curl does not run JavaScript.

4. Look for external loaders. Small scripts from new *.github.io accounts or cheap domains are a red flag. So are names that imitate real CDNs, such as a file called jsdeliver.js on an unrelated domain.

5. Search the source for tell-tale strings: navigator.userAgent, /googlebot/i, SPAM_DETECTED, location.replace, navigator.webdriver and a long /bot|crawl|spider|…/ list.

6. Check the meta tags and schema. A googlebot: indexifembedded meta tag only makes sense on an iframe host like this. Schema links that do not appear on the page are hidden links.

7. Do not trust a plain headless screenshot. It can miss the cloak, as ours did.

Caveat: a cloak that also checks the IP address will treat a fake Googlebot request as a person. If your Googlebot fetch already gets the offer, the page may be IP-gated. It may also have switched to the offer for everyone.

Who is doing this

The 534 script IDs in the top 1,000 cluster into a few templates. Each template has its own URL parameter, layout and outbound domains. A small number of operators, or a few shared kits, run most of the space. We cannot name any person or company behind any network. All WHOIS records we checked are private.

The adult ?id= network

This is the biggest group: 610 pages on 370 scripts, with about 50.5M estimated visits. The pages target adult video-site brand keywords and adult terms in Indonesian, Hindi, Tamil, Arabic, Turkish, Vietnamese and other languages.

• Many pages copy the layout of a Sky Sports article, with adult keywords pasted over the team names.

• An external script sends every non-Googlebot visitor to a Blogger page or an ad site.

• One page ranks #1 in France for an adult-site brand keyword, with zero links.

• Many scripts act as proxies. They fetch the page body from another server each time.

We describe this network only briefly. It is the context for the traffic numbers, not the focus of this piece.

Instagram and Facebook brand hijack, plus ?zex= "viewer" pages

The 75 ?zex= pages and a few ?id= brand-word pages rank for "instagram", "facebook" and "instagram story viewer" queries in 25+ countries. Together they hold about 10.6M estimated visits. This is likely one operation. The pages share templates, random title tags like [il2r20], a date script and redirect hosts.

• A page ranks #3 for "instagram" in India, a 55M-volume query. Google gets "7 Best Private Instagram Viewer Tools".

• Some listed "viewer tools" are phone-monitoring apps, the kind used to spy on a partner or child.

• The page carries fake rating schema: 4.7 stars from 73,816 ratings.

• A script rewrites "Last Updated" to two days in the future.

• One script holds 39 URLs. Two of its ?zex= numbers returned byte-identical HTML. The number only makes a new URL.

• People are sent to newp11.com or newp1.com, registered on 2 Sep and 22 Sep 2026.

All 75 ?zex= pages were alive on 5 Oct 2026.

The ?getf= network: likely one operator across niches

These pages publish generated "reviews" stored in Google Drive. They target adult-AI tools, random video chat (OmeTV and Omegle alternatives), the Kerala lottery and utility searches such as "mic test". Three signals tie them together.

• Same sandbox host suffix. Six scripts share the same last 13 characters of their Google sandbox host name. Unrelated scripts have unique ones.

• Same registrar update, to the second. Three destination domains show the same registry "Updated Date": 2026-10-04T16:27:50Z.

• Same tracking tag. Destinations carry the same source tag, ?v=gs or red=gs.

It's likely that onee operator runs these scripts. Each niche goes to its own offer domain. This looks like a traffic-arbitrage business. The OmeTV page even uses a crypto-casino review template, with headings like "Payments & deposits" left in.

The GLP-1 affiliate

One script, 23+ US pages, one offer funnel. Both offer pages, "TrimRx" and "Oak", sit on bestglprecommend.com subdomains. Both use the same affiliate ID (a=302537) and the same Facebook pixel. So one buyer account runs both.

The sister "Oak" offer page. Its buttons go to a different tracker domain, with the same affiliate ID a=302537. Direct capture, 5 Oct 2026.

The operator signals point to China or Hong Kong. Both the article and the Oak page use Chinese analytics. The bare script shows a "not found" message in Chinese. The dead canonical domain has a Hong Kong registrant, and a beacon domain has a Chinese one. (These are signals only. They do not identify anyone. The offer pages also carry Spanish code comments, which suggests they were copied from a network's own landing page. We could not tell whether the TrimRx brand authorised this traffic.

The globalinterndesk.com survey network

At least six scripts carry a call-to-action link to globalinterndesk.com/ecc/<offer>. They include the Gemini guide, the Singapore earn-money farm, the "20 Game Apps" page, a currency page factory and a Roblox-executor page. The domain was registered on 24 Dec 2025. None of these pages is cloaked.

AI page factories

Some scripts are complete content factories on Google's free infrastructure. The currency script exposes 34 functions, such as automateCurrencyPages, generateSeoContent, savePageToDrive and setupDailyTrigger. The earn-money script calls OpenAI. A piracy script builds a download page for any film in a public film database.

MetaSwap

The crypto-only shop from example 5 is a different kind of actor. It does not send people elsewhere. Apps Script is its whole shop and back end. We do not know who runs it.

Who gets hurt

• Patients. A GLP-1 page next to Mayo Clinic tells readers to "share your medication with others" and raise doses without supervision.

• Partners and children. "Instagram viewer" pages promote phone-monitoring apps under a brand search for "instagram".

• Rights holders. Piracy pages rank #1 for film and sports-stream queries.

• Ordinary searchers. Fake "are you a robot" boxes trick people into clicking through to offers.

• Third parties. One proxy script's error message names a remote file on a US college subdomain. That host may be misused or abandoned. We did not verify this or contact the host.

• Brands. Instagram, Facebook, Bitget, Hostinger, TrimRx and Lycamobile appear on pages they do not control.

Timeline: Google's own hosts, one after another

Spammers have used free Google-hosted pages to rank for years. The hosts overlap. A new one does not replace the old one. Apps Script is the latest, and the cycle has sped up.

Apps Script itself is not new to abuse. Phishers have used script.google.com links since at least 2021, because security filters trust the domain (Kaspersky, 2021; Check Point, 2024; BleepingComputer, 2025). What is new is ranking at scale in Google Search.

1. By April 2017: Google My Maps

   Spammers filled My Maps pages with pirate and torrent links. (Reported) TorrentFreak, 22 Apr 2017.

2. November 2022: Data Studio (now Looker Studio)

   Threat actors used datastudio.google.com report pages to boost rankings for torrent and pirated-content sites. (Verified) BleepingComputer, 18 Nov 2022.

3. Mid-2022 to at least July 2023: Colab notebooks

   Sucuri found hacked sites linking to 141,341 Colab notebook URLs with Russian-language gambling spam. The spam came from "a little bit over a hundred Gmail accounts", with "around 1,000 spam documents per account". The notebooks reached the first page of Google for their title keywords. (Verified) Sucuri, 18 Jul 2023.

4. December 2023 to February 2024: Google Groups

   Groups got a large ranking boost, with "super-dangerous content… ranking for sensitive queries" (Glenn Gabe). Visibility dropped from about 7 Dec 2023. Google ended Usenet posting and viewing on Groups from 22 Feb 2024, partly because of spam. (Verified) SER, 13 Dec 2023; SER, 3 Jan 2024.

5. 2023–2025: Docs, Sites and Maps

   In January 2024, Lily Ray told Fortune: "Google Docs, Google Maps, Linkedin, Reddit, anywhere you can imagine that there is a forum, spammers are taking advantage of it." (Verified) Fortune, 18 Jan 2024. Caveat: she gave no numbers, and "Google Maps" may mean listings or reviews, not My Maps pages. For Google Sites, we found only undated practitioner forum threads. Google Docs still get indexed fast in September 2026, per Jesper Nissen. (Reported)

6. 5 March 2024: Google announces the site reputation abuse policy

   Google announced three new spam policies: expired domain abuse, scaled content abuse and site reputation abuse. (Verified) Search Central blog, 5 Mar 2024.

7. May 2024: Enforcement starts

   The policy took effect on 5 May. Manual actions against big publishers began on the evening of 6 May. (Verified) SER, 7 May 2024.

8. 19 November 2024: The policy widens

   Third-party content made to exploit a host's signals violates the policy "regardless of whether there is first-party involvement or oversight". (Verified) Search Central blog, 19 Nov 2024. On 13 Nov 2025, Google also published "Defending Search users from 'Parasite SEO' spam", the same day the European Commission opened a DMA investigation. Google blog, 13 Nov 2025.

9. 19–23 September 2026: Gemini Notebook (NotebookLM) pages

   Charles Floate posted first on 19 Sep. Gagan Ghotra spread it on 21 Sep, and Glenn Gabe reshared it. Barry Schwartz wrote it up on SE Roundtable on 22 Sep: Google had indexed more than 12,000 spam notebook pages. Gabe reported on 23 Sep that Google had "nuked" them from the results. (Verified) SER, 22 Sep 2026. The notebook pages we checked on 5 Oct now send noindex. The Apps Script pages do not.

10. From about 23 September 2026: Apps Script web apps scale up

    On 23 Sep, indexing-tool vendor Jesper Nissen wrote that "Google scripts" were the "new Parasite property". Ahrefs shows the /macros/ path jumping from near zero to about 23,000 ranking pages in the last days of September. (Verified) But this is not proof of a start date. Some live pages carry August dates, such as a footer reading "Verificado: 30/08/2026". Ahrefs only says the pages are new since 4 July. The pages existed from late August, and Google started ranking them at scale in the second half of September.

Short version: My Maps (2017) · Data Studio (2022) · Colab (2022–23) · Groups (2023) · Docs (2024–) · Gemini Notebook (19–23 Sep 2026) · Apps Script (from about 23 Sep 2026).

Two Google spam updates sit nearby. The August 2026 spam update started on 18 Aug. The September 2026 spam update started on 24 Sep and was still rolling out on 5 Oct. (Verified) Google ranking release history. We cannot say whether either one touched these pages.

Other findings

These pages live fast and die fast

The biggest page in the export is already dead. It had 11.88M estimated visits and ranked #1 in Indonesia for an adult-site brand keyword. On 5 Oct it returned only a one-line "page not found" message in Bengali. Ahrefs still counts it. (Verified)

We checked all 610 adult ?id= pages on 5 Oct 2026. (Verified)

Live check of the adult ?id= network, 5 Oct 2026. Traffic is the Ahrefs estimate from 4 Oct.

Most failures are not Google takedowns. Only 7 of 610 show a Google error. The rest come from the operator's side: content pulled from the remote server, or the free fetch quota used up. Some pages switch to the offer for everyone after they rank. A Kerala-lottery page that ranked with an article now serves only a full-screen offer frame. A #1 page for "cracked streams" now shows a Google "No item with the given ID" error.

Expect pages to last days to a few weeks. Google removed notebook spam about a day after SE Roundtable covered it. The Instagram network shows no decay yet. Every one of its pages was alive on 5 Oct.

AI answers: strong in Google, weak elsewhere

GEO (generative engine optimisation) means getting cited or recommended by AI answer engines. Apps Script is a poor host for it outside Google.

• The page text sits inside a JavaScript string. A crawler that does not run JavaScript sees only the title: 35 characters on the indexing-tool page.

• OpenAI, Anthropic and Perplexity crawlers do not run JavaScript, per a 2024 Vercel/MERJ study. Gemini uses Google's rendering.

• An LLM fetch tool read the indexing-tool page and reported "only a title".

• 984 of the top 1,000 pages have zero AI responses in Ahrefs. The other 16 appear in 307 AI responses in total. None is adult.

One page stands out. "20 Game Apps That Pay Real Money" has 216 AI responses and ranks for 639 keywords. It is a long, uncloaked list with comparison tables and a "red flags" section. Its sister pages add 41 and 15 AI responses. We do not know which engines cited it, because the platform split is locked in our Ahrefs plan.Google AI Overviews or AI Mode are the likely source. Google's only rule for AI features is that a page is indexed and can show a snippet (Google docs). These pages pass that rule.

The GLP-1 operator hides from AI crawlers on purpose. The Instagram and adult networks check only for "Googlebot". So an AI crawler that runs JavaScript would be sent to their offers like a person.

Who else is reporting this

• SE Roundtable, 22 Sep 2026. Barry Schwartz covered the Gemini Notebook spam. He credited Gagan Ghotra and Glenn Gabe, and noted that Charles Floate spotted it first. The story is about notebooks, not Apps Script. SER.

• Jesper Nissen, 23 Sep 2026. The first public SEO mention of "Google scripts" as a parasite host, ranking for "best google indexing tool". He runs a competing indexing service, Primeindexer, so weigh his view with that in mind. He has not followed up. Post.

• TraceX Labs, 30 Sep 2026. A security threat report on Apps Script abuse for phishing, fraud, adult spam, gambling, piracy and SEO manipulation. It gives no counts, no URLs and no operator names. Report. Several Indian news sites re-wrote it between 30 Sep and 2 Oct with no new data.

• Google: no statement found as of 5 Oct 2026.

• Search Engine Land and Search Engine Journal: no coverage found. We searched with a non-Google index, so this is a weak negative.

As far as we can tell, this is the first data-driven write-up of Apps Script ranking spam.

What this means for SEOs and marketers

Do not use this for clients. At Synscribe, we will not sell it, use it on client work or link it to our own site. The pages are short-lived. They sit on the same host as adult and cloaking networks. They do almost nothing in ChatGPT or Perplexity. The risk to a brand is larger than any ranking gain.

Learn to spot it. A result with the site name "Google" and a script.google.com › macros › exec breadcrumb is not an official Google page. It is a page made by any Apps Script user. Check the function names, run Google's Rich Results Test, and look at where the buttons go.

Report it when it hits your SERPs. If a parasite page outranks you or a client, use the "Report abuse" link on the page banner and Google's spam report. First confirm it is spam and not a real app. Real apps rank for their own name, have links and history, and use real function names.

What we will watch.

• Weekly checks of "best indexing tool" and "best google indexing tool", with first-seen and last-seen dates for each Apps Script URL. Nobody has published lifespan data yet.

• Whether Google adds noindex to /exec pages, as it did for notebooks.

• Whether the Instagram network survives the September spam update.

• Which AI engines cite these pages, if we can get the platform split.

The bigger lesson is about Google's free hosts. They have become a revolving door, and Google closes each one by hand. Colab lasted about a year. Notebooks lasted days. Apps Script went from near zero to tens of thousands of ranking pages in about two weeks. Durable SEO and GEO still come from pages and mentions that every crawler can read.

Appendix: method, tables and sources

This appendix holds the detail behind the article. Long tables are folded. Open the ones you need.

Method and evidence grades

• Ahrefs data. Ahrefs Site Explorer "Top pages" export for path script.google.com/macros/, all locations, taken 4 Oct 2026 at 22:28 SGT. It holds the top 1,000 of 23,377 pages, which carry about 98% of the estimated traffic. The comparison date is 4 Jul 2026. The export gives only the top keyword per page. Traffic is a model estimate (Ahrefs help).

• Classification. Each of the 1,000 rows was labelled by top keyword and URL slug, with keyword rules in about a dozen languages. About 60 live pages were checked by hand.

• Live fetches. Researchers fetched pages with curl on 4–5 Oct 2026 from Singapore, with a Chrome user agent and a Googlebot user agent. They decoded the userHtml string from the Apps Script wrapper. They did not run JavaScript, except for the screenshot captures. They did not open adult or scam destinations.

• Screenshots. SERP screenshots were taken by Raymond in Google from Singapore on 5 Oct 2026. Page captures used headless Chrome with the user agent set on every frame.

• WHOIS and GitHub. Domain dates come from whois, and account dates from the GitHub API, on 5 Oct 2026.

• (Verified) = we fetched or checked it on 4–5 Oct 2026. (Reported) = a third party says it. (Inference) = our reading, with no source that confirms it.

• Main limit. Our Googlebot requests came from non-Google IPs. IP-based cloaks would treat them as people.

Case-file summary: 27 pages checked on 5 Oct 2026

Ahrefs export, 4 Oct 2026 (top keyword, country, position, estimated traffic). "Live" is our fetch on 5 Oct 2026. Adult keywords are described, not quoted.

Niche breakdown of the top 1,000 pages

Ahrefs export, 4 Oct 2026, classified by top keyword and slug. Traffic is estimated.

URL parameters in the top 1,000: ?id= 667 rows (51.0M), ?zex= 75 (10.6M), ?getf= 85 (1.3M), ?ids= 37 (1.2M), ?vid= 20, ?p= 16. Only 33 rows have no query string. Traffic is concentrated: the top 10 pages carry 59% of the export's traffic.

Country split

Share of estimated traffic by top-keyword country, Ahrefs export, 4 Oct 2026. 51 countries appear in total.

"—" means the page count was not broken out in our notes. The US leads only in the "cleaner-looking" niches: all 22 GLP-1 pages, adult-AI tool reviews, random video chat, free TikTok likes and phone lookup.

Operator clues by network

Checked 4–5 Oct 2026. These clues link pages to each other. None identifies a person or company.

All 22 GLP-1 slugs in the Ahrefs top 1,000

One script, all US, Status New, UR 0, 0 referring domains, 0 AI responses. Ahrefs export, 4 Oct 2026. Total estimated traffic 94,899.

Function-name tells: how to read the functionNames list

Every /exec wrapper lists the script's server functions in plain text. Checked 5 Oct 2026.

A page factory is a method, not proof of spam. Look for the other tells as well. These include user-agent checks, full-screen iframes and offer domains under a year old with private WHOIS. Also check for no backlinks and no rankings before July 2026.

GEO and Bing: technical details

• The raw /exec response carries the setTitle value in <title> and as the iframe title. The body is an escaped string inside goog.script.init(…). Client JavaScript draws it into an iframe on n-<string>-0lu-script.googleusercontent.com. (Verified)

• No robots.txt on these Google hosts blocks AI or search bots. The limit is JavaScript, not access. (Verified)

• A curl fetch of the indexing-tool page returned 35 characters of readable text: the title. (Verified)

• Some operators add <meta name="googlebot" content="indexifembedded">. This tag tells Google to index content shown inside an iframe. (Verified)

• AI Overviews: in 2026 studies, only 17–38% of AIO citations come from the top 10 results (SEJ). A high rank is a real but unreliable route to a citation. (Reported)

• ChatGPT's share of listicle citations fell from 15.8% to 7.8% after an August 2026 model update (MarketMaze, on Peec AI data). (Reported)

• Bing: automated site: queries returned unrelated pages, so we could not measure Bing coverage. The evidence is two manual screenshots. Whether ChatGPT search can see these pages through Bing is unproven.

• Jesper Nissen reported that the AI Overview for "best google indexing tool" disappeared when the spam arrived. (Reported)

Open questions and limits

• We analysed only the top 1,000 of 23,377 pages. The other ~22,400 pages carry about 1.5M estimated traffic.

• We have no first-seen date per page. Ahrefs says only "new since 4 Jul 2026".

• We did not check the live Google rank of most pages. Positions come from Ahrefs and our own screenshots.

• We do not know what real Googlebot, from a Google IP, receives.

• We do not know whether the sandbox host suffix really identifies the owner account. A test with two accounts would settle it.

• We did not open any offer destination. Final offers on newp11.com, globalinterndesk.com and the GLP-1 trackers are unknown.

• We do not know which AI engines produced the 216 AI responses.

• We could not confirm the current rank of the indexing-tool page. Search engines blocked automated queries.

• We found no verified Indonesian gambling ("slot gacor") page on Apps Script. Do not repeat that claim.

• We have no traffic or conversion data from anyone who runs these pages.

Sources

News and industry reports

• Barry Schwartz, "Gemini Notebook Pages Spamming Google Search", SE Roundtable, 22 Sep 2026. seroundtable.com

• Jesper Nissen, "Parasite SEO is evolving so fast right now", 23 Sep 2026. ghost.io

• Jesper Nissen, "Google Sheets index in Google", 25 Sep 2026. ghost.io

• Jesper Nissen, "Google Docs is indexing and ranking in Google", 28 Sep 2026. ghost.io

• Barry Schwartz, Google September 2026 spam update, SE Roundtable, 24 Sep 2026. seroundtable.com; second wave, 1 Oct 2026. seroundtable.com

• Denis Sinegubko, "Massive Google Colaboratory Abuse", Sucuri, 18 Jul 2023. sucuri.net

• Ax Sharma, Google Search results poisoned via Data Studio, BleepingComputer, 18 Nov 2022. bleepingcomputer.com

• Spammers populate Google Maps with pirate links, TorrentFreak, 22 Apr 2017. torrentfreak.com

• Google Groups dropping in ranking visibility, SE Roundtable, 13 Dec 2023. seroundtable.com; Usenet removal, 3 Jan 2024. seroundtable.com

• "Why is Google Search so bad?", Fortune, 18 Jan 2024 (Lily Ray quote). fortune.com

• Google enforcing site reputation abuse policy, SE Roundtable, 7 May 2024. seroundtable.com; policy expanded, 20 Nov 2024. seroundtable.com

• "The rise of the AI crawler", Vercel and MERJ, late 2024. vercel.com

• AI Overview citations from top-ranking pages, Search Engine Journal, 2026. searchenginejournal.com

• ChatGPT listicle citation share, MarketMaze (Peec AI data), 2026. marketmaze.me

• Ahrefs, "best X" lists research, 2025. ahrefs.com; self-promotional content experiment. ahrefs.com

Security reports

• TraceX Labs, Google Apps Script abuse threat report, 30 Sep 2026. tracexlabs.com (PDF). Re-written by The Blunt Times (30 Sep), Udaipur Times (1 Oct), Digital Gabbar (1 Oct) and RSWebsols (2 Oct).

• Kaspersky, Google Apps Script phishing, 27 Jul 2021. kaspersky.com

• Check Point, phishing campaign exploiting Google Apps Script, 19 Sep 2024. checkpoint.com

• BleepingComputer, threat actors abuse Google Apps Script in evasive phishing attacks, 29 May 2025. bleepingcomputer.com

• Google developer forum, Apps Script project suspended with no appeal route, 2024. discuss.google.dev

Google documentation and announcements

• New spam policies (incl. site reputation abuse), Search Central blog, 5 Mar 2024. developers.google.com

• Site reputation abuse update, Search Central blog, 19 Nov 2024. developers.google.com

• "Defending Search users from 'Parasite SEO' spam", Google blog, 13 Nov 2025. blog.google

• Site reputation policy update for the EEA, Search Central blog, 28 Aug 2026. developers.google.com

• Spam policies for Google web search. developers.google.com

• Google Search ranking release history. developers.google.com

• Google's common crawlers (incl. Google-InspectionTool). developers.google.com

• AI features and your website. developers.google.com

• Apps Script: Web Apps guide. developers.google.com

• Apps Script: HtmlService reference (getUserAgent). developers.google.com

• Apps Script: HtmlOutput reference. developers.google.com

• Apps Script: HTML Service restrictions. developers.google.com

• Apps Script: Templated HTML. developers.google.com

• Apps Script: Deployments. developers.google.com

• Apps Script: Quotas. developers.google.com

• Apps Script: Terms of service. developers.google.com

• Ahrefs help: how organic traffic is calculated. help.ahrefs.com

First-party data

• Ahrefs Site Explorer "Top pages" export, path script.google.com/macros/, 4 Oct 2026, and screenshots of 4–5 Oct 2026.

• Google and Bing SERP screenshots, 5 Oct 2026.

• Live fetches, decoded page HTML, WHOIS lookups and page captures by Synscribe researchers, 4–5 Oct 2026.

Spam, affiliate and adult destination domains are named as plain text and not linked. Apps Script spam URLs are not linked.

About this piece. Raymond Yeh is the founder of Synscribe, a leading AI-native SEO and GEO agency. We wrote this so SEOs, marketers and Google can recognise the pattern. We did not create, run or promote any of the pages described. Do you have more data, or run one of the brands named here? Tell us, and we will add a dated note to this page.