Google Dorking for OSINT: The Complete Operator Reference & Investigation Playbook (2026)

Google supports ~25 search operators in 2026, but has deprecated 12+ since 2010 — including cache: (2024) and related: (2023). No new operators added since 2019. Yet the remaining operators still expose misconfigured servers and leaked credentials at scale: a 2025 peer-reviewed study reports 43% of organizations admitting at least one internet-facing weakness discoverable via dorks (Thilakarathne & Alabdulatif, Computers 14(1):24, 2025). An earlier version of this page also quoted “74% of findings rated high severity”; we could not trace that figure to any source and have withdrawn it.

What Google Search Operators Still Work in 2026?

Google Search Central's official documentation, last updated December 10, 2025, formally lists only four operators: site:, filetype:, imagesize:, and src:. In practice, Google recognizes far more. The table below reflects real-world testing and expert consensus as of early 2026.

Core operators (reliable)

The before: and after: operators have remained in "beta" status since their introduction in April 2019 — over six years without graduating to stable. Danny Sullivan confirmed the required format is YYYY-MM-DD or just YYYY. Results can be inconsistent because websites handle date metadata unreliably. Google's built-in Tools → Custom Date Range filter is often more reliable for date filtering.

Unreliable operators (use with caution)

Several operators still technically function but produce inconsistent results. AROUND(X), Google's proximity operator, theoretically finds pages where two terms appear within X words of each other — but multiple sources report it frequently ignores the proximity constraint. The numeric range operator (..) works better with dollar signs ($200..$500) than plain numbers. The @ and # symbols, once listed on Google's help pages for social media and hashtag searching, now produce results largely indistinguishable from normal queries. inanchor: and allinanchor: return incomplete data. And daterange:, which requires Julian date format, has been effectively superseded by before:/after:.

Syntax rules investigators must know

No space is permitted between an operator and its parameter — site:example.com works but site: example.com does not. OR and AND must be uppercase; lowercase versions are treated as ordinary words. The allin* family (allintitle:, allinurl:, allintext:) should never be combined with other operators in the same query, as this produces unpredictable results. Google caps queries at 32 keywords and 2,048 characters per keyword.

Which Google Operators Were Removed and When?

Google has removed at least 12 operators over the past 15 years. Many popular guides published in 2024–2025 still list cache: and related: as working — this is incorrect.

The pattern is clear: Google removes operators that serve power users or could expose sensitive data, replacing them with simplified, AI-driven experiences. No new operators have been added in 2024, 2025, or early 2026. For OSINT practitioners, the loss of cache: was the most impactful — it was a cornerstone technique for viewing deleted or modified pages. The Wayback Machine at web.archive.org is the closest replacement, though coverage is inconsistent.

How Do Search Operators Compare Across Engines?

For OSINT professionals, using multiple search engines is not optional — it's essential methodology. Each engine indexes different content, applies different filters, and supports different operators. The matrix below covers the six engines most relevant to investigators.

Key takeaway: site: is the only operator universally supported across all six engines. DuckDuckGo disabled most operators in April 2023 and only partially restored them — reliability varies by query. Yahoo Search has been powered by Bing since 2010 and inherits all Bing operators. Brave's operators are labeled "experimental" and may be silently dropped when too few results match. For comprehensive OSINT dorking, use a dork generator that builds queries for multiple engines simultaneously.

Operator support by engine (verified October 2026)

The matrix above summarises community consensus. The table below is narrower and stricter: it lists only operators we could confirm on 6–7 October 2026 against each engine's own documentation (Google, Bing, DuckDuckGo, Yandex, Brave) or in the 6 October 2026 audit of our own Dork Generator. A dash means we did not verify that cell and you should test before relying on it.

Takeaway: only site:, exact quotes and - behave the same on all five engines, so every other operator in a cross-engine dork needs a per-engine translation — which is exactly what the Dork Generator now does for Bing (instreamset:url:, parenthesised OR, filetype: for ext:).

Dorks that stopped working or changed in 2025–2026

These are the breakages investigators most often hit when reusing dorks from older guides. Each entry says what to use instead.

Takeaway: none of the five core operators (site:, filetype:, intitle:, inurl:, intext:) was removed from Google in 2025–2026; the breakages are the long-gone cache: and dorks copied unchanged from Google to an engine that spells the operator differently.

What Unique Operators Does Bing Offer for OSINT?

Bing offers several operators with no Google equivalent, making it indispensable for certain investigation types.

The ip: operator alone makes Bing essential for infrastructure reconnaissance. Combined with linkfromdomain: for mapping a target's external relationships, Bing provides capabilities that Google users simply cannot access. Note that Microsoft suspended inurl: in 2007 to prevent data mining — it has never been restored.

Why Is Yandex the OSINT Investigator's Secret Weapon?

Yandex stands apart for three reasons critical to OSINT work: facial recognition in reverse image search, a unique operator syntax with capabilities no other engine matches, and deep indexing of Russian-language content Google barely touches.

rhost:

Reverse host search — finds pages hosted on a specific domain, using Yandex's own crawl data independent of DNS records. No Google equivalent.

date:

Date-range filtering with rich syntax (date:20240101..20241231). More reliable than Google's before:/after: operators.

mime:

Yandex's equivalent to filetype: but supports additional MIME types and is more consistent in results.

Reverse Image Search

Yandex's image search includes facial recognition AI that can match faces across the web — a capability Google deliberately excludes for privacy reasons. Critical for OSINT identity investigations.

Yandex-specific operators

Yandex uses different names for common functions: mime: instead of filetype:, title: instead of intitle:, and host: for hostname-specific searches. Its rhost: (reverse host) operator — where the hostname is written in reverse order (e.g., rhost:com.example.*) — enables powerful TLD-wide searches impossible on Google. The date: operator supports rich syntax including exact dates, ranges, and comparison operators (date:>20240101, date:20240101..20240630). The domain: operator filters by top-level domain.

Yandex also offers morphological control no other engine provides. The ! operator before a word prevents Yandex from applying morphological variations (case, tense, number). Square brackets [] preserve word order. The single tilde ~ excludes a word only within the same sentence, while double tilde ~~ acts as a full NOT operator. These are especially powerful when searching Russian-language content, where word forms vary extensively.

Why Yandex excels at reverse image search

In systematic comparative testing, Yandex outperformed both Google and Bing across facial recognition, text-in-image recognition, and identification of modified photos. Yandex's reverse image search incorporates facial recognition AI that searches for people who look similar, not just identical images. It successfully identified individuals from desaturated, tilted, contrast-adjusted, and even upside-down photos where Google failed. Yandex also recognizes text within images in non-Latin alphabets (Cyrillic, Thai). For investigators working Eastern European subjects, Yandex is the first-choice tool. Use it alongside our multi-engine search directory for full cross-engine coverage.

Current accessibility

Yandex search remains accessible internationally as of early 2026 despite the July 2024 sale of Yandex's Russian operations for $5.3 billion. It holds 66–74% of Russian search market share. It is blocked in Latvia, Ukraine, and a few other countries, but accessible from the US and most of the EU. For more on Yandex's evolution, see our 2026 search engine landscape report.

What OSINT Investigation Patterns Do Professionals Actually Use?

The following patterns represent real-world techniques drawn from the SANS Institute, Exploit-DB's GHDB, Maltego, and the OSINT practitioner community. All are intended for defensive security, authorized investigations, and educational purposes. Use our Google Dork Generator to build these queries interactively without memorizing syntax. The “Open in the Dork Generator” links below pass the target of each example (a keyword, domain or username) to the generator, which then builds the whole family of related dorks for Google, Bing and Yahoo with the operator spelling corrected for each engine.

Exposed files and misconfigurations

The classic directory listing dork remains one of the most effective:

Open “backup” in the Dork Generator →

For modern web applications, exposed environment files are devastating — they contain database credentials and API keys that should never be publicly accessible:

Open “DB_PASSWORD” in the Dork Generator →

WordPress configuration files with database credentials:

Cloud storage misconfigurations — indexed Amazon S3 buckets and public Trello boards with credentials:

Open “confidential” in the Dork Generator →

Reconnaissance and target profiling

Subdomain enumeration uses iterative exclusion — start broad and progressively exclude discovered subdomains:

Open “example.com” in the Dork Generator →

Employee discovery and role identification on LinkedIn:

Open “company name” in the Dork Generator →

Technology stack identification — detecting WordPress, exposed API documentation, and server technology:

Open “example.com” in the Dork Generator →

Cross-platform identity linking:

Open “username123” in the Dork Generator →

Government and public records

Government reports, SEC filings, and FOIA responses are all discoverable through targeted dorking:

Open “annual report” in the Dork Generator →

Developer credential exposure

GitHub is one of the most common sources of accidentally exposed credentials:

What Is the Google Hacking Database and Is It Still Active?

The Google Hacking Database (GHDB), maintained by Offensive Security via Exploit-DB, remains the most authoritative curated collection of dorks. Created by Johnny Long starting in 2002, it organizes thousands of curated entries across 14 categories: Footholds, Files Containing Usernames, Sensitive Directories, Web Server Detection, Vulnerable Files, Vulnerable Servers, Error Messages, Files Containing Juicy Info, Files Containing Passwords, Sensitive Online Shopping Info, Network or Vulnerability Data, Pages Containing Login Portals, Various Online Devices, and Advisories and Vulnerabilities.

The GHDB remains accessible at exploit-db.com/google-hacking-database with the most recent visible submissions dating to late 2023. Community alternatives have emerged: GitHub repositories like cipher387's Dorks-collections-list aggregate contributions, and specialized databases exist for Shodan, Censys, and GitHub-specific dorks. The automated tool Pagodo executes GHDB queries with built-in rate limiting.

Do AI Search Engines Support Search Operators?

The rise of AI-powered search creates a two-speed landscape where traditional operators and natural language increasingly coexist.

Perplexity AI explicitly supports search operators including site:, filetype:, inurl:, before:, and after: — and uniquely allows combining them with natural language prompts. For example: site:who.int Mpox filetype:pdf 2024; summarize case trends. Processing roughly 30 million queries daily, Perplexity represents the clearest integration of operator precision with AI synthesis.

ChatGPT Search accepts site: within prompts but has no formal operator documentation; behavior is emergent. Google AI Mode and AI Overviews, used by more than 1 billion and 2.5 billion monthly users respectively (Google, May 2026), appear to respect operators like site: in the underlying retrieval layer, though the AI summary may not always honor constraints. Microsoft Copilot Search (launched April 2025) is grounded on Bing results, so Bing operators logically influence its retrieval.

The practical impact is democratization: investigators who previously needed to memorize operator syntax can now describe what they want in natural language and let AI construct the query. AI tools can generate dork queries from plain English descriptions — but they cannot replace the precision of a well-crafted operator chain when investigating specific targets.

How Do You Turn Off AI Overviews and Get the Raw Index?

The biggest shift for investigators in 2026 is not a lost operator — it is that Google now answers many queries with an AI Overview instead of the ten blue links, and that summary layer quietly reshapes or hides the raw results dorking depends on. There is a documented way to strip it off.

The udm=14 trick. Google’s results are segmented by a udm ("unified data model") parameter that selects the result type. udm=14 forces the classic "Web" results view — no AI Overview, no widgets, just links and your operators applied to the raw index. Append it to a search URL, or search on udm14.com or set it as a custom search engine:

https://www.google.com/search?q=site:example.com+filetype:pdf&udm=14

Two related levers are worth knowing. Adding -ai or another guaranteed-zero-result exclusion can suppress the AI Overview on some searches by breaking the conditions that trigger it, though this is far less reliable than udm=14. And in Google’s own interface, the Web filter under "More" does the same thing as udm=14 by hand. For operator-driven OSINT, udm=14 should be your default: an AI summary that "may not honor constraints" (as the table above notes) is worse than useless when you are relying on site: and filetype: to be exact.

This matters because the raw index is where dorking lives. For the fuller argument on why AI search is narrowing what investigators can find — and a broader toolkit for forcing search engines to show you everything — Henk van Ess’s "So you still think you can Google?" is the sharpest recent treatment.

How Is Google Fighting Automated Dorking?

Google deployed SearchGuard in January 2025, a JavaScript challenge system described as costing "tens of thousands of person hours and millions of dollars of investment." In December 2025, Google sued SerpApi in the Northern District of California under the DMCA, alleging the company sends "hundreds of millions of automated queries" daily — a 25,000% increase over two years. The case has since turned against Google: the court dismissed Google's DMCA claims on 20 July 2026 (with leave to amend), Google filed an amended complaint on 10 August 2026 citing its content-licensing terms, and SerpApi's renewed motion to dismiss is set for hearing on 29 September 2026 before Chief Judge Yvonne Gonzalez Rogers.

For individual investigators, Google's detection threshold sits at roughly 15–20 queries per hour before triggering CAPTCHAs. Detection signals include request frequency, IP reputation, browser fingerprinting, and behavioral patterns (missing mouse movements, scroll patterns, click behaviors). The escalation path runs from CAPTCHA challenges to temporary blocks to IP bans.

Google's Terms of Service explicitly prohibit automated queries. Manual dorking — typing queries by hand — is not prohibited. The legal distinction matters: in Star Kashman's comprehensive 2023 analysis in the Washington Journal of Law, Technology & Arts, the conclusion was that dorking as a standalone act remains legal, but it could facilitate actions resulting in criminal prosecution. Every known prosecution charged individuals for actions taken after dorking, not for the search queries themselves. The Max Intel Dork Generator builds queries you then execute manually — it does not send automated queries to any search engine.

What Does the Future of Dorking Look Like?

Three developments define the 2026 dorking landscape. First, Google is actively hostile to automated dorking (SearchGuard, the SerpApi lawsuit), pushing investigators toward manual queries or alternative engines. Second, AI search engines — especially Perplexity — are creating a hybrid model where natural language and structured operators coexist, lowering the skill barrier while maintaining precision for power users. Third, the steady deprecation of operators (12+ removed, zero added since 2019) means the available toolkit is shrinking.

The strategic advantage now lies in multi-engine proficiency: using Google for its superior index size and before:/after: date filtering, Bing for ip: and linkfromdomain: infrastructure mapping, and Yandex for facial recognition and Russian-language content. Investigators who treat dorking as a Google-only activity are leaving significant intelligence on the table. Our Google Dork Generator builds queries for Google, Bing and Yahoo with the operators translated per engine, and our search engine directory catalogs 80+ engines (with pre-filled results links for 57 of them) for multi-engine investigation workflows.

The core toolkit remains powerful despite the deprecation trend. Five operators — site:, filetype:, intitle:, inurl:, and intext: — form the backbone of virtually every investigation query, and all five work across most engines. The fragmentation of search operator support mirrors the broader fragmentation of OSINT tools — where free tools disappear behind paywalls and self-hosted alternatives become essential. The future belongs to those who chain operators across engines, leverage each platform's unique capabilities, and adapt to a landscape where AI synthesis and traditional precision increasingly overlap.