Google Dorking for OSINT: The Complete Operator Reference & Investigation Playbook (2026)

What Google Search Operators Still Work in 2026?

Google Search Central's official documentation, last updated December 10, 2025, formally lists only four operators: site:, filetype:, imagesize:, and src:. In practice, Google recognizes far more. Google Search Help also documents quotes, -, before: and after:. Google Search Help (checked 18 Oct 2026) The table below reflects real-world testing and expert consensus as of early 2026, corrected on 16 October 2026 for inurl: and on 18 October for the date operators. GIJN / Henk van Ess (14 Oct 2026)

Core operators (reliable)

Google Search Help now documents before: and after:, which arrived in 2019. Use a year (before:2019) or a full date (after:2026/03/10 or after:2019-03-01), and combine both for a range. Google Search Help (checked 18 Oct 2026) Results can still be inconsistent because websites handle date metadata unreliably. Google's built-in Tools → Custom Date Range filter is often more reliable for date filtering.

Unreliable operators (use with caution)

Several operators still technically function but produce inconsistent results. AROUND(X), Google's proximity operator, theoretically finds pages where two terms appear within X words of each other. But multiple sources report it frequently ignores the proximity constraint. The numeric range operator (..) works better with dollar signs ($200..$500) than plain numbers.

The @ and # symbols, once listed on Google's help pages for social media and hashtag searching, now produce results largely indistinguishable from normal queries. inanchor: and allinanchor: return incomplete data. And daterange:, which requires Julian date format (a running count of days), has been effectively superseded by before:/after:.

Syntax rules investigators must know

No space is permitted between an operator and its parameter — site:example.com works but site: example.com does not. OR and AND must be uppercase; lowercase versions are treated as ordinary words. The allin* family (allintitle:, allinurl:, allintext:) should never be combined with other operators in the same query, as this produces unpredictable results. Google caps queries at 32 keywords and 2,048 characters per keyword.

Which Google Operators Were Removed and When?

Google has removed at least 12 operators over the past 15 years. Many popular guides published in 2024–2025 still list cache: and related: as working — this is incorrect.

The pattern is clear: Google removes operators that serve power users or could expose sensitive data, replacing them with simplified, AI-driven experiences. No new operators have been added in 2024, 2025, or early 2026. For OSINT practitioners, the loss of cache: was the most impactful — it was a cornerstone technique for viewing deleted or modified pages. The Wayback Machine at web.archive.org is the closest replacement, though coverage is inconsistent.

How Do Search Operators Compare Across Engines?

For OSINT professionals, using multiple search engines is not optional — it's essential methodology. Each engine indexes different content, applies different filters, and supports different operators. The matrix below covers the six engines most relevant to investigators.

Key takeaway: site: is the only operator universally supported across all six engines. DuckDuckGo says some of its advanced syntax "isn't operating 100% correctly on all queries" DuckDuckGo Help (checked 18 Oct 2026). Yahoo shows Bing results, but Yahoo’s help documents no operators Yahoo Help, so we mark its column “—” (not documented). Test any operator on Yahoo before relying on it. Brave's operators are labeled "experimental" and may be silently dropped when too few results match. For comprehensive OSINT dorking, use a dork generator that builds queries for multiple engines simultaneously.

Operator support by engine (verified October 2026)

The matrix above summarises community consensus. The table below is narrower and stricter. It lists only operators we could confirm on 6–7 October 2026 against each engine's own documentation (Google, Bing, DuckDuckGo, Yandex, Brave). Operators confirmed in the 6 October 2026 audit of our own Dork Generator also count. A dash means we did not verify that cell and you should test before relying on it.

Takeaway: only site: and exact quotes behave the same on all five engines (DuckDuckGo treats - as “fewer results with this word”). Every other operator in a cross-engine dork needs a per-engine translation. That is exactly what the Dork Generator does for Bing (parenthesised OR, filetype: for ext:). For words in a URL, only DuckDuckGo of the five engines in this table still documents inurl:. Mojeek and Kagi also document it Mojeek Kagi, though Kagi users reported it failing in September 2026 Kagi feedback forum. On Google and Bing, a site: path prefix is the documented route.

Dorks that stopped working or changed in 2025–2026

These are the breakages investigators most often hit when reusing dorks from older guides. Each entry says what to use instead.

Takeaway: of the five core operators (site:, filetype:, intitle:, inurl:, intext:), only inurl: stopped working on Google, in 2026. The other breakages are the long-gone cache: and dorks copied unchanged from Google to an engine that spells the operator differently.

What Unique Operators Does Bing Offer for OSINT?

Bing offers several operators with no Google equivalent, making it indispensable for certain investigation types.

The ip: operator alone makes Bing essential for infrastructure reconnaissance. Combined with contains: and feed:, and the undocumented linkfromdomain: for outbound links, Bing offers searches Google does not. Microsoft also retired the Bing Search APIs on 11 August 2025, so these operators now need the website, not an API. Note that Microsoft suspended inurl: in 2007 to prevent data mining — it has never been restored.

Why Is Yandex the OSINT Investigator's Secret Weapon?

Yandex stands apart for three reasons critical to OSINT work. It offers facial recognition in reverse image search and a unique operator syntax with capabilities no other engine matches. Its third strength is deep indexing of Russian-language content Google barely touches.

rhost:

Reverse host search — finds pages hosted on a specific domain, using Yandex's own crawl data independent of DNS records. No Google equivalent.

date:

Date-range filtering with rich syntax (date:20240101..20241231). It also accepts date:202310* for a month and date:2023* for a year. Yandex Support, search operators

mime:

Yandex's equivalent to filetype: but supports additional MIME types and is more consistent in results.

Reverse Image Search

Yandex's image search includes facial recognition AI that can match faces across the web — a capability Google deliberately excludes for privacy reasons. Critical for OSINT identity investigations.

Yandex-specific operators

Yandex uses different names for common functions: mime: instead of filetype:, title: instead of intitle:, and host: for hostname-specific searches. Its rhost: (reverse host) operator writes the hostname in reverse order (e.g., rhost:com.example.*). This enables powerful searches across a whole top-level domain (TLD), impossible on Google. The date: operator supports rich syntax including exact dates, ranges, and comparison operators (date:>20240101, date:20240101..20240630). The domain: operator filters by top-level domain.

Yandex also offers morphological control no other engine provides. The ! operator before a word prevents Yandex from applying morphological variations (case, tense, number). Yandex’s current English help documents - for exclusion (put it at the end of the query), plus +, quotes and |. It no longer lists the older ~, ~~ or [ ] forms. Yandex Support, search context (checked 18 Oct 2026) These are especially powerful when searching Russian-language content, where word forms vary extensively.

Why Yandex excels at reverse image search

In systematic comparative testing, Yandex outperformed both Google and Bing across facial recognition, text-in-image recognition, and identification of modified photos. Yandex's reverse image search incorporates facial recognition AI that searches for people who look similar, not just identical images. It successfully identified individuals from desaturated, tilted, contrast-adjusted, and even upside-down photos where Google failed.

Yandex also recognizes text within images in non-Latin alphabets (Cyrillic, Thai). For investigators working Eastern European subjects, Yandex is the first-choice tool. Use it alongside our multi-engine search directory for full cross-engine coverage.

Current accessibility

Yandex search remains accessible internationally as of early 2026 despite the July 2024 sale of Yandex's Russian operations for $5.3 billion. It holds 66–74% of Russian search market share. It is blocked in Latvia, Ukraine, and a few other countries, but accessible from the US and most of the EU. For more on Yandex's evolution, see our 2026 search engine landscape report.

How Do You Dork Chinese Company, Procurement and Court Records on Baidu?

Search in Chinese on Baidu, then confirm on the official portal. Chinese company, tender and court records are mostly published in Chinese on government (gov.cn) sites, so an English Google search misses most of them. The most useful free reference we have found is Argelius Labs’ bilingual China Web OSINT Search Dorks field guide, version 1.0, last reviewed 21 June 2026. It is published under a CC BY 4.0 licence, which allows reuse with credit. Argelius Labs (21 Jun 2026) The table below condenses its dorks for the jobs investigators ask about most: companies, regulators, procurement and courts.

Which Baidu operators work? The guide documents exact quotes, -term (a space before the minus, none after), site:, filetype: and intitle:. It warns that Baidu may rewrite a query, ignore an operator or show only sampled results, so a thin result set does not prove that nothing exists. For URL filtering it recommends Baidu’s Advanced Search page “if inurl: behaves inconsistently”.

Read the hits with care. An award notice “does not prove the contract was signed, performed, accepted, or paid”, the guide warns. Commercial company-data platforms such as Qichacha, Tianyancha and Aiqicha are useful leads, but the guide says to check important facts against official records. Some sensitive searches return warning banners or reduced results. Treat that “as an observation about the search environment”, not as proof of why a page is missing.

A workflow that holds up. The guide’s 10 steps start with a specific question and the company’s exact Chinese name and identifiers. Next, build an alias list: Chinese and English names, former names, identifiers and domains. Run one broad query, then add one pivot term at a time and narrow by site or file type. Search each identifier on its own, then move to the official portals. Repeat in other indexes and in platforms’ own search, and verify, preserve and cite every important claim. The Dork Generator’s Baidu option builds the company, procurement, regulator and court dorks above from a company name.

This section adapts material from China Web OSINT Search Dorks (Bilingual Field Guide), version 1.0, published by Argelius Labs under CC BY 4.0. We selected and condensed the dorks, added English glosses and reworded the cautions. The guide names no individual author.

What OSINT Investigation Patterns Do Professionals Actually Use?

The following patterns represent real-world techniques drawn from the SANS Institute, Exploit-DB's GHDB, Maltego, and the OSINT practitioner community. All are intended for defensive security, authorized investigations, and educational purposes. Use our Google Dork Generator to build these queries interactively without memorizing syntax. The “Open in the Dork Generator” links below pass the target of each example (a keyword, domain or username) to the generator. The generator then builds the whole family of related dorks for Google, Bing and Yahoo, with the operator spelling corrected for each engine.

Exposed files and misconfigurations

The classic directory listing dork remains one of the most effective:

Open “backup” in the Dork Generator →

For modern web applications, exposed environment files are devastating — they contain database credentials and API keys that should never be publicly accessible:

Open “DB_PASSWORD” in the Dork Generator →

WordPress configuration files with database credentials:

Older guides use inurl:wp-config.php here; Google no longer executes inurl: reliably, so this version looks for the file name in an open directory listing instead.

Cloud storage misconfigurations — indexed Amazon S3 buckets and public Trello boards with credentials:

Open “confidential” in the Dork Generator →

Reconnaissance and target profiling

Subdomain enumeration uses iterative exclusion — start broad and progressively exclude discovered subdomains:

Open “example.com” in the Dork Generator →

Employee discovery and role identification on LinkedIn:

Open “company name” in the Dork Generator →

Technology stack identification — detecting WordPress, exposed API documentation, and server technology:

Open “example.com” in the Dork Generator →

Cross-platform identity linking:

Open “username123” in the Dork Generator →

Government and public records

Government reports, SEC (US securities regulator) filings, and FOIA (Freedom of Information Act) responses are all discoverable through targeted dorking:

Open “annual report” in the Dork Generator →

Developer credential exposure

GitHub is one of the most common sources of accidentally exposed credentials:

What Is the Google Hacking Database and Is It Still Active?

The Google Hacking Database (GHDB), maintained by Offensive Security via Exploit-DB, remains the most authoritative curated collection of dorks. Created by Johnny Long starting in 2002, it organizes thousands of curated entries across 14 categories. They are Footholds, Files Containing Usernames, Sensitive Directories, Web Server Detection, Vulnerable Files, Vulnerable Servers, Error Messages, and Files Containing Juicy Info. The others are Files Containing Passwords, Sensitive Online Shopping Info, Network or Vulnerability Data, Pages Containing Login Portals, Various Online Devices, and Advisories and Vulnerabilities.

The GHDB remains accessible at exploit-db.com/google-hacking-database with the most recent visible submissions dating to late 2023. Community alternatives have emerged: GitHub repositories like cipher387's Dorks-collections-list aggregate contributions, and specialized databases exist for Shodan, Censys, and GitHub-specific dorks. The automated tool Pagodo executes GHDB queries with built-in rate limiting.

Do AI Search Engines Support Search Operators?

The rise of AI-powered search creates a two-speed landscape where traditional operators and natural language increasingly coexist.

Perplexity AI accepts operators such as site: and filetype: in prompts, according to user guides, and lets you mix them with plain language. For example: site:who.int Mpox filetype:pdf 2024; summarize case trends. We found no official Perplexity operator list, so check that the sources it cites match your filters.

ChatGPT Search accepts site: within prompts but has no formal operator documentation; behavior is emergent. Google AI Mode and AI Overviews are used by more than 1 billion and 2.5 billion monthly users respectively (Google, May 2026). Google does not document operator support in either. AI Mode splits a question into many sub-searches (“query fan-out”). In July 2026 tests, AI Overviews sometimes ignored operators, and AI Mode treated a pasted dork as text to discuss rather than instructions OSINT Combine (22 Jul 2026). For exact results, use the Web filter or udm=14. Microsoft Copilot Search (launched April 2025) is grounded on Bing results, so Bing operators logically influence its retrieval.

The practical impact is democratization: investigators who previously needed to memorize operator syntax can now describe what they want in natural language. They can then let AI construct the query. AI tools can generate dork queries from plain English descriptions — but they cannot replace the precision of a well-crafted operator chain when investigating specific targets.

How Do You Turn Off AI Overviews and Get the Raw Index?

The biggest shift for investigators in 2026 is not a lost operator. It is that Google now answers many queries with an AI Overview instead of the ten blue links (the classic list of results). That summary layer quietly reshapes or hides the raw results dorking depends on. There is a documented way to strip it off.

The udm=14 trick. Google’s results are segmented by a udm ("unified data model") parameter that selects the result type. udm=14 forces the classic "Web" results view — no AI Overview, no widgets, just links and your operators applied to the raw index. Append it to a search URL, or search on udm14.com or set it as a custom search engine:

https://www.google.com/search?q=site:example.com+filetype:pdf&udm=14

Two related levers are worth knowing. Adding -ai or another guaranteed-zero-result exclusion can suppress the AI Overview on some searches. It works by breaking the conditions that trigger the Overview, though it is far less reliable than udm=14. And in Google’s own interface, the Web filter under "More" does the same thing as udm=14 by hand.

For operator-driven OSINT, udm=14 should be your default. The table above notes that AI Mode often ignores operators. When you are relying on site: and filetype: to be exact, such a summary is worse than useless.

This matters because the raw index is where dorking lives. For the fuller argument on why AI search is narrowing what investigators can find, see Henk van Ess’s "So you still think you can Google?". It is the sharpest recent treatment, and adds a broader toolkit for forcing search engines to show you everything.

How Is Google Fighting Automated Dorking?

Google deployed SearchGuard in January 2025, a JavaScript challenge system described as costing "tens of thousands of person hours and millions of dollars of investment." In December 2025, Google sued SerpApi in the Northern District of California under the DMCA. Google alleged the company sends "hundreds of millions of automated queries" daily — a 25,000% increase over two years.

The case has since turned against Google. The court dismissed Google's DMCA claims on 20 July 2026 Claims over results with no copyrighted content were dismissed for good; claims over licensed content, such as Knowledge Panel images, could be refiled. Google filed an amended complaint on 10 August 2026 citing its content-licensing terms. SerpApi moved to dismiss the amended complaint on 24 August 2026 (ECF 49), set for hearing on 29 September 2026 before Chief Judge Yvonne Gonzalez Rogers. As of 18 October 2026 we found no published ruling. Check the public CourtListener docket for the outcome.

Google has also made bulk collection harder in quieter ways. Since September 2025 it ignores the &num=100 parameter, so one results page shows about 10 results; Google said the parameter is “not something that we formally support” (Search Engine Land). Google’s Custom Search JSON API is closed to new customers and shuts down on 1 January 2027 (Google for Developers). Microsoft retired the Bing Search APIs on 11 August 2025 (Microsoft Learn).

For individual investigators, Google's detection threshold sits at roughly 15–20 queries per hour before triggering CAPTCHAs (tests that check you are human). Detection signals include request frequency, IP reputation, browser fingerprinting, and behavioral patterns (missing mouse movements, scroll patterns, click behaviors). The escalation path runs from CAPTCHA challenges to temporary blocks to IP bans.

Google's Terms of Service explicitly prohibit automated queries. Manual dorking — typing queries by hand — is not prohibited.

The legal distinction matters. In 2023, Star Kashman published a comprehensive analysis in the Washington Journal of Law, Technology & Arts. It concluded that dorking as a standalone act remains legal, but could facilitate actions resulting in criminal prosecution. Every known prosecution charged individuals for actions taken after dorking, not for the search queries themselves. The Max Intel Dork Generator builds queries you then execute manually — it does not send automated queries to any search engine.

What Does the Future of Dorking Look Like?

Three developments define the 2026 dorking landscape. First, Google is actively hostile to automated dorking (SearchGuard, the SerpApi lawsuit), pushing investigators toward manual queries or alternative engines. Second, AI search engines are creating a hybrid model where natural language and some operators coexist, though none documents them. This lowers the skill barrier while maintaining precision for power users. Third, the steady deprecation of operators (12+ removed, zero added since 2019) means the available toolkit is shrinking.

The strategic advantage now lies in multi-engine proficiency. Use Google for its superior index size and before:/after: date filtering, and Bing for ip: infrastructure mapping. Use Yandex for facial recognition and Russian-language content. Investigators who treat dorking as a Google-only activity are leaving significant intelligence on the table.

Our Google Dork Generator builds queries for Google, Bing and Yahoo with the operators translated per engine. Our search engine directory catalogs 80+ engines (with pre-filled results links for 57 of them) for multi-engine investigation workflows.

The core toolkit remains powerful despite the deprecation trend. Four operators — site:, filetype:, intitle: and intext: — form the backbone of virtually every investigation query. A fifth, inurl:, stopped working reliably on Google in 2026; site: with a URL path now does that job. The fragmentation of search operator support mirrors the broader fragmentation of OSINT tools — where free tools disappear behind paywalls and self-hosted alternatives become essential. The future belongs to those who chain operators across engines, use each platform's unique capabilities, and adapt as AI synthesis and traditional precision increasingly overlap.