I spent $200 a month to SEO-poison Google search results

23 Aug 2026

I check my credit card statements every once a while just to see if there are unrecognized costs. This month, I saw a whopping $600 bill from Google AI Studio. This was not cool. I knew I vibe coded things, but no way it could use this much tokens. Maybe something I built went viral? Maybe someone stole my API tokens for their own use?

Turns out, I was getting trolled by Google all the time.

Generative UI Demos

Earlier this year, I built several fun demos around agentic generative UI - basically it’s a web page where everytime you open, instead of displaying a static site, an LLM model would be streaming content of a site it makes up on-the-fly, and you gradually see a new site getting vibed live. The first demo I built it’s called Vibe Builder, where you type in a prompt and it builds the site on the fly. The second demo I built it’s a Hacker News clone - where AI completely makes up every single post, user, and comment on a HN-looking web page. The second demo allows you to also navigate across pages, and AI remembers the navigation and vibes the new sites as you click into the links.

The Hacker News clone website calls a backend API when it’s being loaded, and that API again calls Gemini to generate and stream the live page components one-by-one and it gets appended to the DOM tree accordingly by the receiving JS logic on the HTML page.

So what went wrong?

Debugging Cost

The first thing I need to check is the API spending patterns.

From Google AI Studio’s view, I see that in July on average I used ~$20 worth of Gemini tokens per day. It kind of got better in early August, but lately the usage came back and it’s even more active than last month. Maybe I’m getting some real traffic!?

Checking the requests chart, it also aligns with the cost chart, showing that something definitely used AI more than others.

I then proceeded to check the activities on Cloudflare, where I configured all my DNS at - wasn’t able to show too much breakdown details. Then I checked Heroku, where I hosted these demos at. That gave me an indicator - the Hacker News clone app gets constant hourly traffic, while the other apps were kind of meh and dying alone.

From Heroku logs, I saw that all the traffic were coming from the same IP - the mysterious 192.178.7.168. This IP address is constantly spamming my site and because of how the LLM logic is wired up, then it’s constantly draining my account…

192.178.7.168

What is this IP address? I did a quick reverse lookup.

The results point back to the hostname of crawl-192-178-7-168.googlebot.com. The name is pretty obvious - it’s one of Google’s web crawlers that scans the web and builds up search indices.

Then everything made sense - the website is totally made from vibes every time, so the content and the navigation links on the web page is always different every time one sends an request. This confused the hell out of the crawler and it keeps on expanding the queries to my website, because everytime it discovers new routes. Hence it causes an infinite loop of token burn.

Dammit, Google

So now I know why. Maybe I need to somehow hide the AI generated content from the Google crawlers, or I need to configure some kind of ROBOT txt file to tell Google to stop burning my tokens. Or maybe, I should really just shut down the site.

I have lost $600 on this already. But what about Google? They must have built a wild index around all the vibed websites that Gemini generated, right? Then I did a cursory search on Google:

Looks like all the fake news generated by Gemini have hit the Google search index. I can see all the shitpost AI made in the Google search results…

And the results are like 10+ pages long. Maybe one day, when you search online, you’ll come across one of the fake Hacker News articles that Gemini generates and got indexed by Google.

Takeaways

Well, I guess it’s a bad idea to closely couple an LLM call with the GET request of the index page of a website. You never know who’s knocking on the doors. And a simple DDOS attack would instantly vaporize my wallet if not handled carefully.

My site and the API keys are still alive by the time I publish this post. But I added a moderate spend cap to it so it won’t easily explode. I guess this is lesson learned for me ;)