Are 35% of US LinkedIn Members Unemployed? Globally, 320 MLN?

booleanstrings Boolean Leave a Comment

It has occurred to me that the operators not only allow to expand the searching power in “positive ways” but also make it possible to search for the absence of some values. To search for a field not to have any value, we need to know all possible values – and this is true for the “seniority” filter. The seniority codes range from 1 to 10.

We know that people without current jobs do not have a seniority value assigned. Therefore, by excluding all the 10 levels, we should find all unemployed. (People without a job are like “dead souls“). Here is the search for all of them.

All unemployed LinkedIn Members – (, or

NOT(seniority:1 OR(seniority:2) OR(seniority:3) OR(seniority:4) OR(seniority:5) OR(seniority:6) OR(seniority:7) OR(seniority:8) OR(seniority:9) OR(seniority:10))

Right now, the total is 320 MLN. For the US, it is 60K+ unemployed vs. a total of 170 MLN. This means that 35% of American LinkedIn members do not list a current job. Globally, LinkedIn has 44% unemployed members.

Really? The numbers seem way too high, especially as the economy recovers. Surely, there are abandoned profiles but they usually have a “current” position. There must be employed members who are “false positives”. Adding extra filters (example) was showing nice, matching results.

Digging deeper, I have realized that LinkedIn also does not assign seniority to people whose titles it fails to interpret. This is what is responsible for the large numbers! What it means is that 1) there is a lot of “junk” data and 2) LinkedIn can do better at recognizing the non-standard job titles of its members as well. (It is a good reminder to not fully depend on LinkedIn’s selection search for any facet.) The search does find all unemployed but may pull some “false positives” as well, depending on your other keywords.

Please make a note of it. Recruiters, search for the unemployed while the operators allow! Let’s help them find jobs.

An in-depth webinar about mastering the operators and ways to source like a genius on LinkedIn is on its way (will appear on this page). If you have a Recruiter subscription, join this session (which will be just as informative).

The Power of the Hidden Operators

booleanstrings Boolean Leave a Comment

At this time, we have the best free LinkedIn search ever available, surpassing even Recruiter’s in several ways. Searching for skills, exact location, spoken language, fields of study, years of experience, and at school, are welcome (unplanned) additions to the search. The never-documented LinkedIn search operators offer filters that are otherwise paid – or are not offered at all – such as the filter for the headline:

headline:”open to work”.

The searching power of the operators goes beyond utilizing the previously unavailable filters because you can combine the hidden operators and Boolean logic.


Operators allow you to search for members who do NOT have a particular value for a field. For example, you can search for a Developer NOT in the Gaming industry, or a member who has your keywords but is NOT in HR, or a member who speaks Italian and lives outside of Italy:

(NOT geo:italy) spokenlanguage:italian

Boolean Combinations

Since the operators bring back the search from the boxes in the advanced dialog into one string, you can use the Boolean logic unavailable in the faceted dialog. Example:

((NOT company:bank) title:manager) OR (company:bank title:”vice president”)).

Can you still benefit from LinkedIn Recruiter? Yes, though the new version has much weaker functionality than the one before it. Come to the upcoming webinar to learn

how to use Recruiter masterfully!

How to Verify Email Guesses on the Professional Network

booleanstrings Boolean Leave a Comment

“Which tools are best at finding emails”? – seems to be every other question from Recruiters on Facebook groups, always triggering multiple answers. But here is an approach that does not require any Chrome Extensions or other email-finding tools.

If you are looking at someone’s LinkedIn profile or just know someone’s full name and the company name, you can start guessing their email address, either work or private. For example, for a Jason Smith at Amazon, his email may be:

[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]


There are email permutators out there that can give you more suggestions.

And now, you can find out which email is the right one! There’s no need for a paid LinkedIn account. Follow the steps; pause a little between them.

STEP ONE. Check whether you have imported data. If you do, remove it.

STEP TWO. Create a CSV file in the following format:

first last email
jason smith [email protected]
jason smith [email protected]
jason smith [email protected]
jason smith [email protected]
jason smith [email protected]
jason smith [email protected]
jason smith [email protected]

STEP THREE. Upload the file.


Now, in the imported contacts, see the results. The emails associated with LinkedIn accounts bring up the profiles (the first and last name in the input does not matter). The emails that are not associated with profiles show up as the last name from the input file, in our case, “smith”.

What’s (quietly) new and beautiful is that you can see which email points to which profile. That would tell you the correct email address for the person in question! Click on a profile, see the contact:

Here is a twist to the above. If you have a list of email addresses and want to quickly check which ones were used on LinkedIn, here’s a hack variation. Replace the last name by the email in the input:

first last email
jason [email protected] [email protected]
jason [email protected] [email protected]
jason [email protected] [email protected]
jason [email protected] [email protected]
jason [email protected] [email protected]
jason [email protected] [email protected]
jason [email protected] [email protected]

The result will show the email addresses NOT on LinkedIn. Use an Excel function to find those that do point to profiles.

LinkedIn Recruiter, in theory, has an import function, but it has been broken for a while with no estimated fix date. (Recruiter won’t even upload LinkedIn’s own example file). But, if it is fixed, you are still limited to 200 records now. Yet you can upload a thousand or two addresses and see the matches with the free personal contact input, just as described above.

We’ll talk about LinkedIn Recruiter Mastery at our upcoming class on April 21st (Wednesday) – and it includes working outside of the platform to compensate for its deficiencies.


What You Are Missing (in Recruiter)

booleanstrings Boolean Leave a Comment

Are you struggling to find more matching potential candidates in LinkedIn Recruiter? The reason may be that you are using some search fields that restrict your results without your knowledge.

I see two reasons for the search algorithm to challenge us:

  1. The original, kept in place, profile data design does not work well with the actual data that members enter, and poor search follows.
  2. LinkedIn’s “semantic” interpretation of our keywords has ways to go (to put it mildly).

Here are some tips on search variations to expand your coverage in Recruiter.

Company Size

Apparently, about 50% of LinkedIn members do not have an associated company size. (No, it is not an April Fool’s joke.) It is easy to check: search for “all members” with each company size selected, and you will see the results go down fifty percent. (Ask me or David Galley if you want to know how it happens.) If you are searching by company size, you are excluding half of LinkedIn!

Therefore, drop the company size filter from some of your searches, and you will find extra results.

Company Name (Boolean) vs. Company Selection

Often, recruiters have a preference for searching either one way or the other. But to be thorough, it is best to use both. The results will overlap but differ. If in a hurry, use Boolean.

Job Title (Boolean) vs. Job Title Selection

LinkedIn’s idea of “similar” job titles does not reflect the reality in so many cases. So it is best to use Boolean (and be imaginative and thorough when writing your “OR” statements).

For “selections,” LinkedIn Recruiter may bring in “similar terms” that you do not wish to see and miss those you do. But if you have the time, search by selections, too, to possibly see different results.

The difference between the “Boolean” vs. “selections” options to search in all the fields where it is offered is not subtle – results are quite different.

Finding the Unemployed

Another warning: If you select the “function” or “seniority,” you will miss people without current jobs. Company names, types, sizes, years at the company and in position will do the same.

There is more to be said about the Recruiter search that is absent in the help documentation!

We have just announce a LinkedIn Recruiter Mastery webinar for Wednesday, April 21st. Don’t miss it!

Enjoy the Operators While They Last #OSINT

booleanstrings Boolean 10 Comments


The LinkedIn hidden search operators are back! Nobody knows for how long they will work this time (we enjoyed them for a year and a half a while ago). But they offer any LinkedIn user, whether basic or paid, significant searching power and an important filter unavailable with any subscription.

LinkedIn never documented the operators, apart from the less-useful firstname:, lastname:, title:, company:, and school: (all achievable via the advanced dialog). Nobody has any idea who had implemented the other ones. But the code came alive again.

The operators were featured in Nathan Palin’s Bellingcat’s Invitation Is Waiting For Your Response: An Investigative Guide To LinkedIn.

You will find some again-working search examples earlier on my blog, posted when I was discovering the operators. Here are more examples:

You can combine the operators and any search terms.

It very well may be that there are other operators to be discovered. Profiles have tons of data, of which we can search only part. But we can search better while the discovered operators last. 🙂

Please check out our class on some OSINT advanced (often, also hidden) features of LinkedIn, Google, and Custom Search Engines –

Advanced Google and LinkedIn for #OSINT Research.








How to Google for Partial Words in URLs #OSINT

booleanstrings Boolean Leave a Comment

You cannot Google for a part of a word. (The Asterisk * means one or a few words in Google’s search syntax.)

However, using the wonderful Google Custom (or Programmable) Search Engines (CSEs), you can search for partial words in the URLs. The way to do so is to take advantage of CSE URL templates. There, the Asterisk means “part of a URL.”

(Please note that my examples are here mostly to demonstrate the technique. You will need to create CSEs based on your goals.)

How can searching for partial words benefit you? Here is a demo use case. LinkedIn members with degrees, certifications, and licenses often add relevant abbreviations to their last names. The abbreviation spellings vary – some people use periods, some, not. This CSE will search for public LinkedIn profiles for Ph.D.’s who have included the abbreviation as part of their last name, no matter how they spelled it, Ph.D., or PhD. It is achieved by including*ph*d. (You can’t do anything similar in Google “in one shot”).

Example search: chemistry professor.

The next CSE searches for LinkedIn profiles for Maria’s first name variations – e.g., Mary, Marianna, Marie, etc. Templates:*,*.

Example search: java developer san francisco.

You can create a CSE with refinements for people whose names start with each Alphabet letter in the same fashion as the above!

CSEs allow templates as crazy as, for example,*oogle*/*py* (try it: api).

This technique is particularly useful for researching social sites with info of interest in the page URLs (which are usually standardized for each type of info like profiles, blog posts, groups, companies, etc.) Examples of such info are a person’s degree or location, company industry or size, blog post, or news article topics. Now, it is up to you to find more sites and applications! I would be interested to hear your ideas.

(There is a bit of a small font for the method. It will increase the results’ number if you include in the CSE’s “keywords” field the words you would like to see in the results. Keep it in mind. Ping me if you want me to say more.)

Do not miss my OSINT Webinar on March 16th!

Part of Github Just Went Private

booleanstrings Boolean 1 Comment

Social Networks want to be found, so they make some information – most notably, profiles – public, visible to search engines. At the same time, they want members to join and sometimes pay for the search. They also worry about their members’ data privacy. It is a balance for each site – which pages and how much info to let Google find. It is not uncommon for a social site to decide to hide previously visible public info.

So the Surface Web is not only expanding but shrinking too! has recently “lost” public profiles. used to have public email addresses, then switched to them being visible only for logged-in users.

One more surface data loss has just happened. A few days ago, as my friend and colleague Karen Azulai messaged me, Google has stopped showing Github’s “repositories” profile tabs in results. It is unfortunate for us because that tab contains the programming languages. We could X-Ray, say, for a combination of Java, Scala, and Python by using a template inurl:tab=repositories Java Scala Python. But now, even the open-ended inurl:tab=repositories Germany was producing only a handful of results.

Apparently, examining the file with the crawling rules you can find a string

Disallow: /*tab=*

which is responsible for the now-hidden pages.

There are two ways around the challenge.

1. One is to omit the “tab” piece – since the “top” repositories along with the languages are on the main profile as well, it won’t work too badly to search just for “sign in to view email” Java Scala Python

2. Another method is curious. It turns out that Custom Search Engines still find results that Google no longer does – at least for now. Try this: inurl:tab=repositories Java Scala Python

Right now the screenshot shows results – 8 on Google and 23 on a CSE:

It is funny that CSEs “remember” cached pages longer than Google (as the screenshot shows). But these results are going away. The method “One” is the one to use.

Finding new approaches when “surface” data leaves us is a useful skill for anyone who searches on the web. Check out our OSINT-themed webinar Advanced Google and LinkedIn for #OSINT Research coming up this week. It is going to be packed with useful tips.

Did You Know? Ten Google Tips for #OSINT Research

booleanstrings Boolean 1 Comment

Here are ten less-known facts about Google search. (How many of these are you aware of? There are some subtleties there.)

  1. You can restrict page dates either by selecting them under “Tools” after searching or using the operators before: and after:. However, you will be missing the pages that did not clearly tell Googlebot about their dates. Lots of public LinkedIn profiles “do not have” the dates and will be missing.
  2. “show results with the omitted included” seen on the last results page is an important parameter. You can also set the parameter by adding &filter=0 to the end of the search URL. It is good practice to “include omitted” if you are looking for as many results as possible from each site (or the one used along with the site: operator). Do not use the setting when you want to see representative results from various sites or just one correct answer to a question.
  3. Google’s numbers of results higher than a hundred or so are meaningless. Never estimate the number of matching pages looking at the number of results. I can show strings producing few results and starting to produce more if I add extra conditions (which shouldn’t happen). In reality, any search will get fewer than 500 viewable results (that Google will try its best to select).
  4. Images form an Index that is separate from Google’s main Index. This means that you will get a set of different – sometimes very different – results if you repeat a search in Images. The same is true about other specialized searches like Google Scholar.
  5. Travel! You will also get a complimentary set of results if you “travel” to a different region. Google’s advanced dialog’s “region” parameter and switching your IP address to your research destination are both good ideas.
  6. The Asterisk * means “one word or a few shorter words” and allows searching for term proximity. You can vary the number of Asterisks between words to get extra results. It is more reliable than using the operator AROUND (which has worked on and off). Additionally, using the Asterisk, you can manipulate snippets to display info (such as email addresses) for easy scraping.
  7. Combine the operator site: with reverse image search as a search technique. Applications include not only searching for pages on a particular site with someone’s photo but also, for example, finding certified people by certification logos or employees by the company logos on a site like LinkedIn.
  8. Up until recently, Google ignored insignificant (“stop”) words, but it no longer does. It tries to make sense of what you type in as a phrase; compare nyc to boston with nyc from boston.
  9. You can search by Emoji. Applications include looking for contact emails and phone numbers or country flag emojis. You can’t, however, look for emails by using the symbol @ in your searches. This symbol is ignored unless it is at the beginning of a search term. In the latter case, Google will try to find a Twitter account. Google ignores most symbols unless they have a special meaning (like the Asterisk or colons after operators). This post will also not be found by searching for “@” 😉
  10. You can use advanced search operators like site: to control results. We call using it X-Ray. (There are collections of strings out there called “Google dorks” with operator examples but I do not like the word.) Google Custom (or Programmable) Search Engines, a software layer on top of Google’s search, allow you (much) finer control of the results than

You can find more info about these and other Google qualities as well as sample links to search strings in my older posts.

Following my recent presentation at the SANS Institute OSINT conference, which attracted significant interest (they had 4,000-plus logged in), I plan to share relevant tips in posts like the above on the blog. I am also offering a new 90-minute in-depth webinar for everyone who is interested in OSINT and wants to master Google and LinkedIn. Our presentations include the slides, recording, and one month of support (answering your questions). Please register at

Advanced Google and LinkedIn for #OSINT Research – Thursday, February 25th @ 8 to 9 AM Pacific time. Seating is limited.

X-Ray for US Profiles: Solved

booleanstrings Boolean Leave a Comment


This Custom Search Engine –

– searches for US-based LinkedIn profiles only. You can try to fool it, searching by a location in another country, but the results will stay on target. How does it do that?

X-Ray practitioners know that we can narrow to a country – any but the US – using a two-letter country abbreviation, e.g., Not so for the US – our profiles do not live under such a domain (not under Instead, they use links starting with www – but so do numerous profiles in other countries. Many members (unknowingly) have several public profiles – one under, say, and a copy starting with with the same ending. You see where the difficulty lies.

“How to X-Ray for US profiles only?” is a frequently asked question from our students.

If you select the United States under the “region” setting in the Advanced Search and then search, the results will not be perfect, but they will be pretty good. Here is an example: marketing director “paris, france.”

Even though I had asked to search for Paris, the top results are US-based. However, the results are not perfect – some,e Parisians will be there as well and possible people from elsewhere.

The CSE above is built on the same principle. However, CSEs follow the region setting precisely. You will have no false positives using it:

Now let us get back to other country-based profiles. I recommend X-Raying for them in the same way, using (just) as the site to search when Googling. Create a CSE following the same idea. Compared to using the country abbreviation, you will also find profiles that Google indexed only under www – which happens quite a bit.

So, now we know a clean way to X-Ray for the US and other countries – and this is yet another advantage of Custom Search Engines!

I am happy to share that David Galley and my book about CSEs will be available soon. You will find it here:


Virtual Travel for More Matching Results

booleanstrings Boolean Leave a Comment

Google has several location-related settings affecting the search results:

  1. It relies on your IP address to figure out your location, even if you search in incognito
  2. You can set a country (“region”) in the Advanced Search Dialog
  3. You can set a language, and if it is not English, the setting will positively affect searching in that country.

(Google also has country domains like, which affect results only in a minor way.)

In X-Raying LinkedIn, you can use the two-letter country abbreviation, like, to narrow down to that country.

Virtually traveling, combining the above tips, you can narrow down a search to a location with nice precision. Virtual travel skills help to source both locally and globally – as you will see in a minute.

Non-US Locations

While using a country abbreviation under the site: operator guarantees that the results will be based out of it, you might be missing some results that Google indexed under “www” and not “fr.” Narrow down to the region of France to see extra results: The URL addition for virtual travel to France is &cr=countryFR.

Set the language to French to see even more additional results.

Change your IP address to a French-based with TunnelBear or SurfShark VPN and combine – get more results.

US Locations

While there is no sure way to find only US-based profiles, narrowing to the US in the advanced search settings helps quite a bit. Look – paris france – most results will be in the US, due to the “region” setting, in spite of the rare keywords.


If you are searching globally, you have just learned how to expand the number of total results you can get for a search. It works just like we did with the image search, i.e., searching in different categories and combining results. “Move” from one region to another, and the sky is the limit!

I have yet to run some searches and numbers but can see that overlap between regions is small, so it is promising.


  1. Setting a region in the advanced search dialog combined with changing your IP address to that country’s helps to narrow to local results
  2. Searching globally, change the region and IP settings repeatedly to develop a long list of results

(If you were wondering, Bing is largely insensitive to your travel.)