MyRecon OSINTSearch Operators: The OSINT Skill Hiding in the Search Box
The most productive tool in open-source intelligence is not a specialist platform. It is an ordinary search box used precisely, and the difference between typing a name and constructing a query is the difference between four million irrelevant results and the three pages that actually mention the person.
The operators that still work
Search syntax has been quietly pruned over the years. These are the ones that remain reliable across the major engines.
- Quotation marks: exact phrase. "jordan alvarez" finds the name as written, rather than every page containing either word. This is the highest-value operator by a distance.
- site:: restrict to one domain or subdomain. site:example.com searches only that site, which is often better than the site's own search function.
- The minus sign: exclude. "jordan alvarez" -football removes an entire category of noise in one character, and repeated exclusions are how you narrow a common name.
- OR: in capitals, matching either term. Parentheses group them.
- filetype:: restrict by document type. filetype:pdf, and equally docx, xlsx, pptx, csv.
- intitle: and inurl:: the term must appear in the page title or the address. allintitle: and allinurl: require all the terms.
- before: and after:: date bounds, as after:2023-01-01. Useful, and approximate: the engine's idea of a page's date is often wrong.
- The asterisk: a wildcard standing for one or more words inside a quoted phrase.
Retired or degraded, so do not build a method on them: link:, info:, related: in its old form, the leading plus sign, and the tilde for synonyms. Most either return nothing or silently do something else.
Different engines, different indexes
Running the same query in more than one engine is not redundancy. The indexes genuinely differ, and so does the syntax.
- Bing keeps operators the others dropped, including contains: for pages linking to a file type and ip: for pages on a given address, the latter being a rare public way to see other sites on the same host.
- DuckDuckGo supports the common syntax and adds "bang" shortcuts that redirect a query straight into another site's own search.
- Yandex indexes Eastern European and Central Asian content far more thoroughly than the others, which matters for both text and images.
- Independent crawlers such as Mojeek and Marginalia surface small, old and non-commercial pages that the large engines have deprioritised, occasionally the only place an old forum post survives.
Your results are not the results. Search output is personalised by location, language, device, history and whether you are signed in, so two people running an identical query get different pages, and you cannot reproduce your own search a month later. For anything you intend to rely on, work signed out in a private window, record the query and the date, and save the page rather than the link. A finding you cannot reproduce is not evidence.
Auditing your own footprint
The most useful thing most people can do with this syntax is point it at themselves. Work through these and record what comes back.
- "your full name": then with your city, employer, and university in turn. Each addition surfaces a different cluster.
- Your email address in quotes, including old ones. Addresses turn up in leaked mailing lists, committee minutes, forum signatures and conference programmes.
- Your phone number in quotes, in two or three formats, with and without the country code, with and without spaces.
- Every username you have used, current and retired. Handles connect accounts across a decade; the username guide covers what that enumeration finds.
- Your home address in quotes, which finds property listings, planning applications and public registers.
- "your name" filetype:pdf: the single most productive query in a self-audit. Committee papers, membership lists, event attendee rosters, school newsletters and old CVs are published as PDFs and are rarely thought of as public.
- site: against the platforms you use, to see what of yours the engine has indexed from each.
Then act on it: the digital footprint guide covers removal at source, and the data broker guide covers the listings that regenerate.
Checking an organisation or a domain
The same syntax, pointed at a company, answers questions the company's own website will not.
- site:example.com alone gives a rough sense of how much of the site is indexed, a handful of pages for a business claiming years of trading is a contradiction.
- site:example.com filetype:pdf finds the reports, price lists and policy documents that describe how an organisation actually operates.
- "Example Ltd" -site:example.com finds what everyone else says about them, with their own marketing removed.
- "Example Ltd" (complaint OR refund OR "chargeback") surfaces the pattern of disputes, if there is one.
- Quoted snippets of their website text: a distinctive sentence from an "about us" page, searched in quotes, exposes template reuse across dozens of sites when the business is a front. This is one of the most reliable tells there is.
Pair it with the infrastructure checks in how to investigate a suspicious domain; search tells you what a domain says about itself, and the registration record tells you when it started saying it.
Where the line is
Searching a public index is not intrusion. What you do afterwards can be.
Pointing search syntax at other people's systems to enumerate exposed files, unprotected devices and administrative interfaces is a well-known practice, and this guide does not publish recipes for it, not because the syntax is secret, but because the useful half of that activity happens under an authorised testing agreement and the rest is someone trespassing on infrastructure they do not own. Finding an address easily has never been a defence to accessing what is behind it.
The same restraint applies to people. Establishing whether an account contacting you is genuine is reasonable. Assembling a stranger's home address, employer and daily routine because you can is the behaviour the OSINT community spends most of its time distancing itself from, and in many jurisdictions the harassment that follows is an offence regardless of how public each individual fragment was.
A search result is a claim, not a fact. Snippets go stale, pages get edited, names collide, and the engine's summary is frequently not what the page says. Open the source, read it, note the date, and corroborate before it becomes a conclusion, the standard is set out in verifying an OSINT finding.
What search will not do
The index is not the web. Content behind logins, in apps, in private groups and in messaging platforms is absent, and a great deal of what exists is simply not crawled. Search engines also actively suppress some categories, and delisting under privacy law removes results without removing pages.
So the absence of a result means very little. It is evidence that a search engine did not return something today, from your location, signed out, which is a much narrower statement than "it is not on the internet", and confusing the two is how a search-based investigation reaches a confident wrong answer.
Once the search box has told you which handles and addresses of yours are public, check what they are exposed in with the MyRecon tools.
Questions people ask
Do search operators still work?
The core set does: quoted phrases, site:, filetype:, intitle:, inurl:, the minus sign for exclusion, and OR. Several older ones were quietly retired, link:, info:, the plus sign and the tilde among them, and a few that still parse now return approximations rather than exact matching.
Why do I get different results from someone else running the same search?
Search results are personalised by location, language, device, search history and whether you are signed in. For investigative work this is a problem, because it means results are not reproducible. Use a signed-out private window and note the date, and treat any result as a snapshot rather than a fact about the index.
Is it legal to use search operators to find things?
Reading what a public search engine has indexed is not unauthorised access. Using what you find to reach systems or data you have no permission to access is a separate act and is unlawful in most jurisdictions regardless of how easily the address was found.
What is the single most useful operator?
Quotation marks. Exact-phrase matching eliminates most of the noise in a name search, and combining a quoted name with a quoted employer or city is usually enough to find what is public about a person without any other syntax.