Google Dorks for OSINT
Google dorks are searches that use advanced search operators, such as site:, filetype: and quotation marks, to make Google return only the pages, sites or documents you need. In open source research they help find where the same text appears across the web. In our Sprinter network investigation, published in May 2025, the accounts "used identical content, and engaged in coordinated messaging closely aligned with Russian state propaganda".
Text repeated word for word across accounts or sites is the kind of trace that a search with operators can follow. This page sets out which operators Google and Bing document, what happened when we tested them, how to combine them and where the ethical limits lie. Searching is one step of an investigation; the steps around it, from framing the question to writing up findings, are covered separately.
What are Google dorks?
A Google dork is an ordinary search query with one or more operators added, so that Google filters its results by site, file type, date or exact wording. Google's developer documentation states that "Google Search supports several search operators that you can use to refine or target your searches."
The European External Action Service (EEAS) links the term to the Google Hacking Database in its 2024 OSINT guidelines on identity-based disinformation and FIMI, noting that "The Google Hacking Database (GHDB) – also known as Dorks – offers a set of operators used to filter information within the Google search engine, are particularly helpful for refining these searches".
The underlying technique is Boolean search. The Berkeley Protocol on Digital Open Source Investigations (2022 edition), published by the UN Human Rights Office and UC Berkeley, defines it as "an Internet search technique that allows users to combine keywords with operators or modifiers (i.e., AND, NOT, OR) to narrow search results and thereby provide more relevant and specific search results."
Which search operators still work in Google?
The operators to rely on are the ones Google lists on its own help page; in our test, OR and intitle: also worked, while cache: found nothing. The help page, Refine Google searches, introduces six with the words "Here are some popular operators":
quotation marks: "To search for an exact match of a word or phrase: Enter a word or a phrase inside quotes";
site: "To search for results from a specific site: Enter site: in front of a site or domain.";
the minus sign: "To exclude words from your search: Enter - in front of a word that you want to leave out.";
before: "To find documents last updated before a particular date: Enter before: in front of a year or specific date.";
after: "To find documents last updated after a particular date: Enter after: in front of a year or specific date.";
filetype: "To find documents of a particular file type: Enter filetype: in front of the file type."
The same page warns: "Do not put spaces between the operator and your search term." Google's Search Central overview, last updated in December 2025, adds two operators for image search, imagesize: and src:, and says of each: "This search operator only works on Google Images."
Operators such as OR, intitle:, inurl: and cache: are on neither Google page. We ran each example search on this page in the engine named, on 1 November 2026, from Belgium, without signing in to Google. OR and intitle: worked as expected. cache: returned nothing, and inurl: missed our own pages that have "osint" in their address.
How do you combine operators?
You combine operators by typing them into one query with spaces between them, and Google applies all of them at once. Each example below was run in Google, and each describes what it found.
`site:eeas.europa.eu FIMI filetype:pdf` returned PDF documents on the EEAS website, led by its annual reports on foreign information manipulation and interference (FIMI).
`site:euvsdisinfo.eu FIMI after:2026-01-01` returned EUvsDisinfo articles on FIMI dated 2026.
`site:europa.eu deepfake -site:europarl.europa.eu` returned pages from Europol, the European Commission and other EU bodies, and none from the European Parliament among the first results.
`(FIMI OR disinformation) site:nato.int filetype:pdf` returned NATO documents, including research papers from its science and technology organisation.
`intitle:disinformation site:europa.eu` returned EU pages with the word in their title.
The third example also shows how site: treats subdomains. Google's site: documentation gives the example site:example.com, which will "Show results only from the example.com domain (www.example.com and recipes.example.com)."
Start with the operator that limits the most, usually site:, and add one operator at a time, checking what changes. The spacing rule matters in practice: when we typed a space after site: in a search for our own site, the results included a Wikipedia page, because Google no longer treated the domain as a limit.
How are dorks used in fact-checking and disinformation research?
In disinformation research, operators are mostly used to find where the same text, link or document appears, and who published it first. The EEAS guide calls narrative alignment "one of the strongest indicators of coordination, often evidenced by the use of identical or similar text, hashtags, links, images, or memes", and says detecting it "involves searching for these elements across various social networks and search engines to identify shared publication sources."
We tested this with a sentence from the foreword of the EEAS's 2026 report on FIMI threats. The search `"FIMI is a truly global problem" -site:eeas.europa.eu` showed the EUvsDisinfo page that carries the same sentence.
Applying this to the Sprinter case
Our Sprinter network report shows why copied text matters. Besides the identical content quoted above, the report found content that "is copied word-for-word into English on the X account, seemingly translated using Google Translate".
Read against the operators above, a case like this suggests a simple routine. Take one distinctive sentence from the suspect post and search for it in quotation marks. Then exclude the site where you first saw it with -site:, so that only other copies remain. The Berkeley Protocol recommends searching in every relevant language and script, so repeat the search in the original language as well as in the translation.
Google notes that an indexed page "can show up in search results for site: queries that are related to the URL, however it's not guaranteed".
Our advice is to search posts on platforms that search engines index poorly on the platform itself as well, or with the free tools built for each platform.
What about Bing and other search engines?
Bing documents more operators than Google, and in our test the same query found different documents in each. Microsoft's page Advanced search keywords lists, among others:
site:, which "Returns webpages that belong to the specified site.";
filetype:, which "Returns only webpages created in the file type that you specify.";
intitle:, which finds pages with the term in the title;
language:, which "Returns webpages for a specific language.";
url:, which "Checks whether the listed domain or web address is in the Bing index."
Its page on advanced search options adds that "You must capitalize the NOT and OR operators." It also notes that "Only the first 10 terms are used to get search results", and that "Because OR is the operator with lowest precedence, enclose OR terms in parentheses when combined with other operators in a search."
In our Bing tests, `disinformation (site:europa.eu OR site:nato.int) filetype:pdf` returned PDF guides and reports from EU institutions and NATO, and `dezinformacija language:lt` returned Lithuanian pages from public bodies, media and our own Lithuanian site. The Berkeley Protocol's advice applies to every engine: "Different search engines, search tools, search terms and operators will yield different results".
How to search with operators yourself
Write down the question first. A clear question tells you which site, phrase or file type to search for.
Start narrow. Use site: or an exact phrase, then widen the search step by step.
Check the documentation. If an operator is not on Google's or Bing's help pages, test it on a search where you know the answer.
Run the same search in two engines. Google and Bing index different pages.
Record every search. Keep the query, the engine and the date with each result you save.
Archive what you find. Results and pages change, so save a copy before you rely on them.
The fifth step is part of the Berkeley Protocol's standard: "investigators should track their searches and record the pathways to relevant material, including the terms, operators and the search engines that led to that content." For saving pages, the EEAS guide notes that the "WayBack Machine compiles a calendar containing all the archived versions of the same webpage at different times."
Our FIMI 101 course, a 10-hour, self-paced online course, covers the skills and tools to recognise, analyse and counter AI-driven disinformation and FIMI campaigns.
What are the legal and ethical limits?
The EEAS guide reminds investigators that "OSINT itself is a neutral method, and its application depends on the context and intent of its users." Search operators are a standard feature that both engines document for everyone; what you search for, and what you do with the results, is a matter of law and ethics.
Information that anyone can find may still be unfair to collect. The Berkeley Protocol states that "Open source investigators must respect human rights and should be particularly sensitive to the right to privacy". The EEAS guide asks for "adherence to the General Data Protection Regulation (GDPR) and other relevant legal frameworks" and says that "Investigations must balance technical possibilities with ethical appropriateness, minimising harm to individuals and groups."
That is why every example on this page targets public organisations, official documents or published research. Leave out queries that look for passwords, exposed files or people's personal details, and do not use anything such a search turns up.
What search operators do not do
Operators filter what a search engine has indexed; they cannot show what it has not. Google's site: page warns that "The site: operator doesn't necessarily return all the URLs that are indexed under the prefix specified in the query", and that a bare site: search "doesn't rank the results". The pages a site: search shows are therefore only part of what a website holds.
Results also depend on who searches and where. The Berkeley Protocol notes that "Search results may also be influenced by a number of technical factors, including the device used and its location, and the user’s prior search history and Internet activity."
A search result shows that a page contained some words when the engine last read it; it does not show who wrote them or why. To learn who runs a website behind a result, other checks come next.
Frequently asked questions
Is Google dorking legal?
Using operators is ordinary searching; the legal questions start with what you collect, such as personal data.
Why did an operator stop working?
Search engines change their features without notice, so test an operator on a query whose answer you already know.
What is the difference between site: and inurl:?
Google documents site: for limiting results to a domain, its subdomains or a URL prefix. inurl: is not on Google's help pages; in our test it found none of our own pages with "osint" in the address.
Can dorks find deleted pages?
Only while the engine still holds the page; after that, try an archive such as the Wayback Machine.
Get our new analysis by email
We'll tell you when we publish a new article, with a short summary, and invite you to upcoming Debunk.org events.