LinkedIn Search Solved

booleanstrings Boolean Leave a Comment

Searching for professionals on At this time, we have the most powerful – but not officially documented – search ways and filters and cross-referencing ability, exceeding (the expensive) Recruiter’s.

You can search for unique filters such as headlines and self-entered skills, and combine other filters such as company size, type, years of experience, or at school in Boolean expressions. The Boolean “limitations” can be overcome with modified search syntax. You can upload and cross-reference more than 1,500 email addresses vs. Recruiter’s 200.

The extra sourcing power is not documented in LinkedIn’s Help.

Take a look at this comparison and join our webinar next Wednesday to learn all about LinkedIn Sourcing.

Search Filter/Account Type Basic or Business RPS and LinkedIn Recruiter
First/Last Name X X
Network Relationship X X
Industry X X
Headline X*
Current Title (Boolean) X X
Current Company (Boolean) X X
Current Company (Checkbox) X X
Past Company (Boolean) X
Past Company (Checkbox) X X
Years at Current Position/Company X
Years of Experience X* X
Company Size X* X
Company Type X* X
School (Boolean) X
School (Checkbox) X
Years of Study X* X
Field of Study X* X
Degree X
Profile Language X X
Spoken Language X* X
Self-entered Skills X*
Calculated Skills X
My Groups X* X
All Groups X
Location (by place name) X X
Location (zip, radius) X
Connections of X
Seniority X* X
Job Function X* X
Recently Joined X

* use the hidden search operators

Search for Group Members (to Message)

booleanstrings Boolean Leave a Comment

LinkedIn used to limit messages to your Group members to 15 per month. This restriction is gone. If you have a basic or business account, you can message fellow group members without restrictions.

However, Group member search only offers finding people by name. How do you find group members who match a professional requirement?

Here is a way I came up with. You can do an advanced LinkedIn people search for your filters. One of the filters is “connections”, 1st, 2nd, and 3rd level. There is no option to search for group members. To do so, all you need is adding &network=[“A”] to the end of the search URL. Add it after you have searched for other values – searching for your group members at start will break the other filters.

Here is an example search with some filters that would show people you can message – 1st connections and group members.

(BTW, if you want to see a “clean” URL, use a URL decoding tool like this. The above search URL will become more readable, like this:[“1441”]&geoUrn=[“102095887”]&network=[“F”,”A”]&title=manager. Here, &network=[“F”,”A”] stands for the first level connections and group members.)

There is a number of clicks to send a message to someone in the search results. If you go to their profile, you will see groups in common, then you can go there, find the person, and message.

But it beats InMails because it is free.

Combined with the search operators, it makes a business account an excellent option for sourcing. You can also learn to find members’ contact information in the upcoming class Find Anyone’s Contact Info on May 13, 2021.

Be Negative. Find More

booleanstrings Boolean 1 Comment

Can being “negative” help in sourcing? I do not mean to suggest that you will source better results when you are in a bad mood, voice dissatisfaction, or upset others. This is an essay on the Boolean “NOT” logic.

When searching, the productive approach we teach is to imagine the “right” terms you will find and put those terms and variations into the search field(s). We call it “visualize success.”

But many social network members do not follow standards in entering their profile data and forget to include “our” keywords. A Boolean “NOT campaign” is a way to dig deeper and find them.

Search, negating some seemingly necessary keywords or titles, and see which other relevant terms and results show up. Use the newly found terms to iterate the search. This approach discovers members who have not used the “right” keywords on the profiles but are worth reviewing.

For example, you might be struggling to locate a “purple squirrel” with rare coding skills and the title developer OR engineer. Try, in addition, searching for NOT developer NOT engineer and the skills. You will be finding people with the titles lead, coder, technical staff, abbreviations like MTS, etc., some “creative,” and even misspelled titles. (The latter helps if you decide not to hold misspellings against potential candidates.)

The following example search is for two obscure programming languages. Given the scarcity of the talent pool, it may help to search like this:

(malbolge OR lolcode) (NOT title:(developer OR engineer))

The results of such a search will likely include profiles that your competition will miss. (Companies that name their employees in non-standard ways like Technical Yahoo do a good job of protecting them from being sourced!)

Iterate. If most results come from several companies, exclude those companies. Or, if most people with the skills reside in a few locations, exclude them and search again:

aws architect NOT geo:”san francisco” NOT geo:”new york”

NOTs are also necessary for exploratory research, the initial and ongoing part of every sourcing project, and one of the six core skills we test. For example:

  • By negating the desired title, you will find other possible titles that you can use in your searches.
  • By negating the desired skill, you will find people with comparable skills and learn more terminology.
  • By negating the seniority (excluding directors and managers) but using words pointing to someone in charge – as simple as managed or – “in charge” – you will find others. And you will learn how managers call themselves in some cases – some companies have their own “sets” of job titles.
  • You will also find out what the market is like.

The above applies to LinkedIn and LinkedIn Recruiter. But NOTs also help in Googling and to find sites to X-Ray in particular. If you are Googling for sites to source from, search for the terms and start excluding sites appearing in the results one by one, like, etc. You will find useful, targeted sites to source from. Dan Russell of Google likes to write about this. A search engine Millionshort does this type of “thinking” showing results you may not ever see unless you make an effort.



Are 35% of US LinkedIn Members Unemployed? Globally, 320 MLN?

booleanstrings Boolean Leave a Comment

It has occurred to me that the operators not only allow to expand the searching power in “positive ways” but also make it possible to search for the absence of some values. To search for a field not to have any value, we need to know all possible values – and this is true for the “seniority” filter. The seniority codes range from 1 to 10.

We know that people without current jobs do not have a seniority value assigned. Therefore, by excluding all the 10 levels, we should find all unemployed. (People without a job are like “dead souls“). Here is the search for all of them.

All unemployed LinkedIn Members – (, or

NOT(seniority:1 OR(seniority:2) OR(seniority:3) OR(seniority:4) OR(seniority:5) OR(seniority:6) OR(seniority:7) OR(seniority:8) OR(seniority:9) OR(seniority:10))

Right now, the total is 320 MLN. For the US, it is 60K+ unemployed vs. a total of 170 MLN. This means that 35% of American LinkedIn members do not list a current job. Globally, LinkedIn has 44% unemployed members.

Really? The numbers seem way too high, especially as the economy recovers. Surely, there are abandoned profiles but they usually have a “current” position. There must be employed members who are “false positives”. Adding extra filters (example) was showing nice, matching results.

Digging deeper, I have realized that LinkedIn also does not assign seniority to people whose titles it fails to interpret. This is what is responsible for the large numbers! What it means is that 1) there is a lot of “junk” data and 2) LinkedIn can do better at recognizing the non-standard job titles of its members as well. (It is a good reminder to not fully depend on LinkedIn’s selection search for any facet.) The search does find all unemployed but may pull some “false positives” as well, depending on your other keywords.

Please make a note of it. Recruiters, search for the unemployed while the operators allow! Let’s help them find jobs.

An in-depth webinar about mastering the operators and ways to source like a genius on LinkedIn is on its way (will appear on this page). If you have a Recruiter subscription, join this session (which will be just as informative).

The Power of the Hidden Operators

booleanstrings Boolean Leave a Comment

At this time, we have the best free LinkedIn search ever available, surpassing even Recruiter’s in several ways. Searching for skills, exact location, spoken language, fields of study, years of experience, and at school, are welcome (unplanned) additions to the search. The never-documented LinkedIn search operators offer filters that are otherwise paid – or are not offered at all – such as the filter for the headline:

headline:”open to work”.

The searching power of the operators goes beyond utilizing the previously unavailable filters because you can combine the hidden operators and Boolean logic.


Operators allow you to search for members who do NOT have a particular value for a field. For example, you can search for a Developer NOT in the Gaming industry, or a member who has your keywords but is NOT in HR, or a member who speaks Italian and lives outside of Italy:

(NOT geo:italy) spokenlanguage:italian

Boolean Combinations

Since the operators bring back the search from the boxes in the advanced dialog into one string, you can use the Boolean logic unavailable in the faceted dialog. Example:

((NOT company:bank) title:manager) OR (company:bank title:”vice president”)).

Can you still benefit from LinkedIn Recruiter? Yes, though the new version has much weaker functionality than the one before it. Come to the upcoming webinar to learn

how to use Recruiter masterfully!

How to Verify Email Guesses on the Professional Network

booleanstrings Boolean Leave a Comment

“Which tools are best at finding emails”? – seems to be every other question from Recruiters on Facebook groups, always triggering multiple answers. But here is an approach that does not require any Chrome Extensions or other email-finding tools.

If you are looking at someone’s LinkedIn profile or just know someone’s full name and the company name, you can start guessing their email address, either work or private. For example, for a Jason Smith at Amazon, his email may be:

[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]


There are email permutators out there that can give you more suggestions.

And now, you can find out which email is the right one! There’s no need for a paid LinkedIn account. Follow the steps; pause a little between them.

STEP ONE. Check whether you have imported data. If you do, remove it.

STEP TWO. Create a CSV file in the following format:

first last email
jason smith [email protected]
jason smith [email protected]
jason smith [email protected]
jason smith [email protected]
jason smith [email protected]
jason smith [email protected]
jason smith [email protected]

STEP THREE. Upload the file.


Now, in the imported contacts, see the results. The emails associated with LinkedIn accounts bring up the profiles (the first and last name in the input does not matter). The emails that are not associated with profiles show up as the last name from the input file, in our case, “smith”.

What’s (quietly) new and beautiful is that you can see which email points to which profile. That would tell you the correct email address for the person in question! Click on a profile, see the contact:

Here is a twist to the above. If you have a list of email addresses and want to quickly check which ones were used on LinkedIn, here’s a hack variation. Replace the last name by the email in the input:

first last email
jason [email protected] [email protected]
jason [email protected] [email protected]
jason [email protected] [email protected]
jason [email protected] [email protected]
jason [email protected] [email protected]
jason [email protected] [email protected]
jason [email protected] [email protected]

The result will show the email addresses NOT on LinkedIn. Use an Excel function to find those that do point to profiles.

LinkedIn Recruiter, in theory, has an import function, but it has been broken for a while with no estimated fix date. (Recruiter won’t even upload LinkedIn’s own example file). But, if it is fixed, you are still limited to 200 records now. Yet you can upload a thousand or two addresses and see the matches with the free personal contact input, just as described above.

We’ll talk about LinkedIn Recruiter Mastery at our upcoming class on April 21st (Wednesday) – and it includes working outside of the platform to compensate for its deficiencies.


What You Are Missing (in Recruiter)

booleanstrings Boolean Leave a Comment

Are you struggling to find more matching potential candidates in LinkedIn Recruiter? The reason may be that you are using some search fields that restrict your results without your knowledge.

I see two reasons for the search algorithm to challenge us:

  1. The original, kept in place, profile data design does not work well with the actual data that members enter, and poor search follows.
  2. LinkedIn’s “semantic” interpretation of our keywords has ways to go (to put it mildly).

Here are some tips on search variations to expand your coverage in Recruiter.

Company Size

Apparently, about 50% of LinkedIn members do not have an associated company size. (No, it is not an April Fool’s joke.) It is easy to check: search for “all members” with each company size selected, and you will see the results go down fifty percent. (Ask me or David Galley if you want to know how it happens.) If you are searching by company size, you are excluding half of LinkedIn!

Therefore, drop the company size filter from some of your searches, and you will find extra results.

Company Name (Boolean) vs. Company Selection

Often, recruiters have a preference for searching either one way or the other. But to be thorough, it is best to use both. The results will overlap but differ. If in a hurry, use Boolean.

Job Title (Boolean) vs. Job Title Selection

LinkedIn’s idea of “similar” job titles does not reflect the reality in so many cases. So it is best to use Boolean (and be imaginative and thorough when writing your “OR” statements).

For “selections,” LinkedIn Recruiter may bring in “similar terms” that you do not wish to see and miss those you do. But if you have the time, search by selections, too, to possibly see different results.

The difference between the “Boolean” vs. “selections” options to search in all the fields where it is offered is not subtle – results are quite different.

Finding the Unemployed

Another warning: If you select the “function” or “seniority,” you will miss people without current jobs. Company names, types, sizes, years at the company and in position will do the same.

There is more to be said about the Recruiter search that is absent in the help documentation!

We have just announce a LinkedIn Recruiter Mastery webinar for Wednesday, April 21st. Don’t miss it!

Enjoy the Operators While They Last #OSINT

booleanstrings Boolean 11 Comments


The LinkedIn hidden search operators are back! Nobody knows for how long they will work this time (we enjoyed them for a year and a half a while ago). But they offer any LinkedIn user, whether basic or paid, significant searching power and an important filter unavailable with any subscription.

LinkedIn never documented the operators, apart from the less-useful firstname:, lastname:, title:, company:, and school: (all achievable via the advanced dialog). Nobody has any idea who had implemented the other ones. But the code came alive again.

The operators were featured in Nathan Palin’s Bellingcat’s Invitation Is Waiting For Your Response: An Investigative Guide To LinkedIn.

You will find some again-working search examples earlier on my blog, posted when I was discovering the operators. Here are more examples:

You can combine the operators and any search terms.

It very well may be that there are other operators to be discovered. Profiles have tons of data, of which we can search only part. But we can search better while the discovered operators last. 🙂

Please check out our class on some OSINT advanced (often, also hidden) features of LinkedIn, Google, and Custom Search Engines –

Advanced Google and LinkedIn for #OSINT Research.








How to Google for Partial Words in URLs #OSINT

booleanstrings Boolean Leave a Comment

You cannot Google for a part of a word. (The Asterisk * means one or a few words in Google’s search syntax.)

However, using the wonderful Google Custom (or Programmable) Search Engines (CSEs), you can search for partial words in the URLs. The way to do so is to take advantage of CSE URL templates. There, the Asterisk means “part of a URL.”

(Please note that my examples are here mostly to demonstrate the technique. You will need to create CSEs based on your goals.)

How can searching for partial words benefit you? Here is a demo use case. LinkedIn members with degrees, certifications, and licenses often add relevant abbreviations to their last names. The abbreviation spellings vary – some people use periods, some, not. This CSE will search for public LinkedIn profiles for Ph.D.’s who have included the abbreviation as part of their last name, no matter how they spelled it, Ph.D., or PhD. It is achieved by including*ph*d. (You can’t do anything similar in Google “in one shot”).

Example search: chemistry professor.

The next CSE searches for LinkedIn profiles for Maria’s first name variations – e.g., Mary, Marianna, Marie, etc. Templates:*,*.

Example search: java developer san francisco.

You can create a CSE with refinements for people whose names start with each Alphabet letter in the same fashion as the above!

CSEs allow templates as crazy as, for example,*oogle*/*py* (try it: api).

This technique is particularly useful for researching social sites with info of interest in the page URLs (which are usually standardized for each type of info like profiles, blog posts, groups, companies, etc.) Examples of such info are a person’s degree or location, company industry or size, blog post, or news article topics. Now, it is up to you to find more sites and applications! I would be interested to hear your ideas.

(There is a bit of a small font for the method. It will increase the results’ number if you include in the CSE’s “keywords” field the words you would like to see in the results. Keep it in mind. Ping me if you want me to say more.)

Do not miss my OSINT Webinar on March 16th!

Part of Github Just Went Private

booleanstrings Boolean 1 Comment

Social Networks want to be found, so they make some information – most notably, profiles – public, visible to search engines. At the same time, they want members to join and sometimes pay for the search. They also worry about their members’ data privacy. It is a balance for each site – which pages and how much info to let Google find. It is not uncommon for a social site to decide to hide previously visible public info.

So the Surface Web is not only expanding but shrinking too! has recently “lost” public profiles. used to have public email addresses, then switched to them being visible only for logged-in users.

One more surface data loss has just happened. A few days ago, as my friend and colleague Karen Azulai messaged me, Google has stopped showing Github’s “repositories” profile tabs in results. It is unfortunate for us because that tab contains the programming languages. We could X-Ray, say, for a combination of Java, Scala, and Python by using a template inurl:tab=repositories Java Scala Python. But now, even the open-ended inurl:tab=repositories Germany was producing only a handful of results.

Apparently, examining the file with the crawling rules you can find a string

Disallow: /*tab=*

which is responsible for the now-hidden pages.

There are two ways around the challenge.

1. One is to omit the “tab” piece – since the “top” repositories along with the languages are on the main profile as well, it won’t work too badly to search just for “sign in to view email” Java Scala Python

2. Another method is curious. It turns out that Custom Search Engines still find results that Google no longer does – at least for now. Try this: inurl:tab=repositories Java Scala Python

Right now the screenshot shows results – 8 on Google and 23 on a CSE:

It is funny that CSEs “remember” cached pages longer than Google (as the screenshot shows). But these results are going away. The method “One” is the one to use.

Finding new approaches when “surface” data leaves us is a useful skill for anyone who searches on the web. Check out our OSINT-themed webinar Advanced Google and LinkedIn for #OSINT Research coming up this week. It is going to be packed with useful tips.