What You Are Missing (in Recruiter)

booleanstrings Boolean Leave a Comment

Are you struggling to find more matching potential candidates in LinkedIn Recruiter? The reason may be that you are using some search fields that restrict your results without your knowledge.

I see two reasons for the search algorithm to challenge us:

  1. The original, kept in place, profile data design does not work well with the actual data that members enter, and poor search follows.
  2. LinkedIn’s “semantic” interpretation of our keywords has ways to go (to put it mildly).

Here are some tips on search variations to expand your coverage in Recruiter.

Company Size

Apparently, about 50% of LinkedIn members do not have an associated company size. (No, it is not an April Fool’s joke.) It is easy to check: search for “all members” with each company size selected, and you will see the results go down fifty percent. (Ask me or David Galley if you want to know how it happens.) If you are searching by company size, you are excluding half of LinkedIn!

Therefore, drop the company size filter from some of your searches, and you will find extra results.

Company Name (Boolean) vs. Company Selection

Often, recruiters have a preference for searching either one way or the other. But to be thorough, it is best to use both. The results will overlap but differ. If in a hurry, use Boolean.

Job Title (Boolean) vs. Job Title Selection

LinkedIn’s idea of “similar” job titles does not reflect the reality in so many cases. So it is best to use Boolean (and be imaginative and thorough when writing your “OR” statements).

For “selections,” LinkedIn Recruiter may bring in “similar terms” that you do not wish to see and miss those you do. But if you have the time, search by selections, too, to possibly see different results.

The difference between the “Boolean” vs. “selections” options to search in all the fields where it is offered is not subtle – results are quite different.

Finding the Unemployed

Another warning: If you select the “function” or “seniority,” you will miss people without current jobs. Company names, types, sizes, years at the company and in position will do the same.

There is more to be said about the Recruiter search that is absent in the help documentation!

We have just announce a LinkedIn Recruiter Mastery webinar for Wednesday, April 21st. Don’t miss it!

Enjoy the Operators While They Last #OSINT

booleanstrings Boolean 11 Comments


The LinkedIn hidden search operators are back! Nobody knows for how long they will work this time (we enjoyed them for a year and a half a while ago). But they offer any LinkedIn user, whether basic or paid, significant searching power and an important filter unavailable with any subscription.

LinkedIn never documented the operators, apart from the less-useful firstname:, lastname:, title:, company:, and school: (all achievable via the advanced dialog). Nobody has any idea who had implemented the other ones. But the code came alive again.

The operators were featured in Nathan Palin’s Bellingcat’s Invitation Is Waiting For Your Response: An Investigative Guide To LinkedIn.

You will find some again-working search examples earlier on my blog, posted when I was discovering the operators. Here are more examples:

You can combine the operators and any search terms.

It very well may be that there are other operators to be discovered. Profiles have tons of data, of which we can search only part. But we can search better while the discovered operators last. 🙂

Please check out our class on some OSINT advanced (often, also hidden) features of LinkedIn, Google, and Custom Search Engines –

Advanced Google and LinkedIn for #OSINT Research.








How to Google for Partial Words in URLs #OSINT

booleanstrings Boolean Leave a Comment

You cannot Google for a part of a word. (The Asterisk * means one or a few words in Google’s search syntax.)

However, using the wonderful Google Custom (or Programmable) Search Engines (CSEs), you can search for partial words in the URLs. The way to do so is to take advantage of CSE URL templates. There, the Asterisk means “part of a URL.”

(Please note that my examples are here mostly to demonstrate the technique. You will need to create CSEs based on your goals.)

How can searching for partial words benefit you? Here is a demo use case. LinkedIn members with degrees, certifications, and licenses often add relevant abbreviations to their last names. The abbreviation spellings vary – some people use periods, some, not. This CSE will search for public LinkedIn profiles for Ph.D.’s who have included the abbreviation as part of their last name, no matter how they spelled it, Ph.D., or PhD. It is achieved by including linkedin.com/in/*ph*d. (You can’t do anything similar in Google “in one shot”).

Example search: chemistry professor.

The next CSE searches for LinkedIn profiles for Maria’s first name variations – e.g., Mary, Marianna, Marie, etc. Templates: linkedin.com/in/mari*, linkedin.com/in/mary*.

Example search: java developer san francisco.

You can create a CSE with refinements for people whose names start with each Alphabet letter in the same fashion as the above!

CSEs allow templates as crazy as, for example, github.com/*oogle*/*py* (try it: api).

This technique is particularly useful for researching social sites with info of interest in the page URLs (which are usually standardized for each type of info like profiles, blog posts, groups, companies, etc.) Examples of such info are a person’s degree or location, company industry or size, blog post, or news article topics. Now, it is up to you to find more sites and applications! I would be interested to hear your ideas.

(There is a bit of a small font for the method. It will increase the results’ number if you include in the CSE’s “keywords” field the words you would like to see in the results. Keep it in mind. Ping me if you want me to say more.)

Do not miss my OSINT Webinar on March 16th!

Part of Github Just Went Private

booleanstrings Boolean 1 Comment

Social Networks want to be found, so they make some information – most notably, profiles – public, visible to search engines. At the same time, they want members to join and sometimes pay for the search. They also worry about their members’ data privacy. It is a balance for each site – which pages and how much info to let Google find. It is not uncommon for a social site to decide to hide previously visible public info.

So the Surface Web is not only expanding but shrinking too!

Meetup.com has recently “lost” public profiles. Github.com used to have public email addresses, then switched to them being visible only for logged-in users.

One more surface data loss has just happened. A few days ago, as my friend and colleague Karen Azulai messaged me, Google has stopped showing Github’s “repositories” profile tabs in results. It is unfortunate for us because that tab contains the programming languages. We could X-Ray, say, for a combination of Java, Scala, and Python by using a template site:github.com inurl:tab=repositories Java Scala Python. But now, even the open-ended site:github.com inurl:tab=repositories Germany was producing only a handful of results.

Apparently, examining the file with the crawling rules https://github.com/robots.txt you can find a string

Disallow: /*tab=*

which is responsible for the now-hidden pages.

There are two ways around the challenge.

1. One is to omit the “tab” piece – since the “top” repositories along with the languages are on the main profile as well, it won’t work too badly to search just for

site:github.com “sign in to view email” Java Scala Python

2. Another method is curious. It turns out that Custom Search Engines still find results that Google no longer does – at least for now. Try this:

site:github.com inurl:tab=repositories Java Scala Python

Right now the screenshot shows results – 8 on Google and 23 on a CSE:

It is funny that CSEs “remember” cached pages longer than Google (as the screenshot shows). But these results are going away. The method “One” is the one to use.

Finding new approaches when “surface” data leaves us is a useful skill for anyone who searches on the web. Check out our OSINT-themed webinar Advanced Google and LinkedIn for #OSINT Research coming up this week. It is going to be packed with useful tips.

Did You Know? Ten Google Tips for #OSINT Research

booleanstrings Boolean 1 Comment

Here are ten less-known facts about Google search. (How many of these are you aware of? There are some subtleties there.)

  • You can restrict page dates either by selecting them under “Tools” after searching or using the operators before: and after:. However, you will be missing the pages that did not clearly tell Googlebot about their dates. Lots of public LinkedIn profiles “do not have” the dates and will be missing.
  • “show results with the omitted included” seen on the last results page is an important parameter. You can also set the parameter by adding &filter=0 to the end of the search URL. It is good practice to “include omitted” if you are looking for as many results as possible from each site (or the one used along with the site: operator). Do not use the setting when you want to see representative results from various sites or just one correct answer to a question.
  • Google’s numbers of results higher than a hundred or so are meaningless. Never estimate the number of matching pages looking at the number of results. I can show strings producing few results and starting to produce more if I add extra conditions (which shouldn’t happen). In reality, any search will get fewer than 500 viewable results (that Google will try its best to select).
  • Images form an Index that is separate from Google’s main Index. This means that you will get a set of different – sometimes very different – results if you repeat a search in Images. The same is true about other specialized searches like Google Scholar.
  • Travel! You will also get a complimentary set of results if you “travel” to a different region. Google’s advanced dialog’s “region” parameter and switching your IP address to your research destination are both good ideas.
  • The Asterisk * means “one word or a few shorter words” and allows searching for term proximity. You can vary the number of Asterisks between words to get extra results. It is more reliable than using the operator AROUND (which has worked on and off). Additionally, using the Asterisk, you can manipulate snippets to display info (such as email addresses) for easy scraping.
  • Combine the operator site: with reverse image search as a search technique. Applications include not only searching for pages on a particular site with someone’s photo but also, for example, finding certified people by certification logos or employees by the company logos on a site like LinkedIn.
  • Up until recently, Google ignored insignificant (“stop”) words, but it no longer does. It tries to make sense of what you type in as a phrase; compare nyc to boston with nyc from boston.
  • You can search by Emoji. Applications include looking for contact emails and phone numbers or country flag emojis. You can’t, however, look for emails by using the symbol @ in your searches. This symbol is ignored unless it is at the beginning of a search term. In the latter case, Google will try to find a Twitter account. Google ignores most symbols unless they have a special meaning (like the Asterisk or colons after operators). This post will also not be found by searching for “@” 😉
  • You can use advanced search operators like site: to control results. We call using it X-Ray. (There are collections of strings out there called “Google dorks” with operator examples but I do not like the word.) Google Custom (or Programmable) Search Engines, a software layer on top of Google’s search, allow you (much) finer control of the results than Google.com.

You can find more info about these and other Google qualities as well as sample links to search strings in my older posts.

Following my recent presentation at the SANS Institute OSINT conference, which attracted significant interest (they had 4,000-plus logged in), I plan to share relevant tips in posts like the above on the blog. I am also offering a new 90-minute in-depth webinar for everyone who is interested in OSINT and wants to master Google and LinkedIn. Our presentations include the slides, recording, and one month of support (answering your questions). Please register at

Advanced Google and LinkedIn for #OSINT Research – Thursday, February 25th @ 8 to 9 AM Pacific time. Seating is limited.

X-Ray for US Profiles: Solved

booleanstrings Boolean Leave a Comment


This Custom Search Engine –


– searches for US-based LinkedIn profiles only. You can try to fool it, searching by a location in another country, but the results will stay on target. How does it do that?

X-Ray practitioners know that we can narrow to a country – any but the US – using a two-letter country abbreviation, e.g., site:fr.linkedin.com/in. Not so for the US – our profiles do not live under such a domain (not under us.linkedin.com/in). Instead, they use links starting with www – but so do numerous profiles in other countries. Many members (unknowingly) have several public profiles – one under, say, fr.linkedin.com/in and a copy starting with www.linkedin.com/in with the same ending. You see where the difficulty lies.

“How to X-Ray for US profiles only?” is a frequently asked question from our students.

If you select the United States under the “region” setting in the Advanced Search and then search, the results will not be perfect, but they will be pretty good. Here is an example:

site:www.linkedin.com/in marketing director “paris, france.”

Even though I had asked to search for Paris, the top results are US-based. However, the results are not perfect – some,e Parisians will be there as well and possible people from elsewhere.

The CSE above is built on the same principle. However, CSEs follow the region setting precisely. You will have no false positives using it:

Now let us get back to other country-based profiles. I recommend X-Raying for them in the same way, using (just) linkedin.com/in as the site to search when Googling. Create a CSE following the same idea. Compared to using the country abbreviation, you will also find profiles that Google indexed only under www – which happens quite a bit.

So, now we know a clean way to X-Ray for the US and other countries – and this is yet another advantage of Custom Search Engines!

I am happy to share that David Galley and my book about CSEs will be available soon. You will find it here:


Virtual Travel for More Matching Results

booleanstrings Boolean Leave a Comment

Google has several location-related settings affecting the search results:

  1. It relies on your IP address to figure out your location, even if you search in incognito
  2. You can set a country (“region”) in the Advanced Search Dialog
  3. You can set a language, and if it is not English, the setting will positively affect searching in that country.

(Google also has country domains like google.com.ua, which affect results only in a minor way.)

In X-Raying LinkedIn, you can use the two-letter country abbreviation, like site:fr.linkedin.com/in, to narrow down to that country.

Virtually traveling, combining the above tips, you can narrow down a search to a location with nice precision. Virtual travel skills help to source both locally and globally – as you will see in a minute.

Non-US Locations

While using a country abbreviation under the site: operator guarantees that the results will be based out of it, you might be missing some results that Google indexed under “www” and not “fr.” Narrow down to the region of France to see extra results: site:linkedin.com/in. The URL addition for virtual travel to France is &cr=countryFR.

Set the language to French to see even more additional results.

Change your IP address to a French-based with TunnelBear or SurfShark VPN and combine – get more results.

US Locations

While there is no sure way to find only US-based profiles, narrowing to the US in the advanced search settings helps quite a bit. Look –  site:linkedin.com/in paris france – most results will be in the US, due to the “region” setting, in spite of the rare keywords.


If you are searching globally, you have just learned how to expand the number of total results you can get for a search. It works just like we did with the image search, i.e., searching in different categories and combining results. “Move” from one region to another, and the sky is the limit!

I have yet to run some searches and numbers but can see that overlap between regions is small, so it is promising.


  1. Setting a region in the advanced search dialog combined with changing your IP address to that country’s helps to narrow to local results
  2. Searching globally, change the region and IP settings repeatedly to develop a long list of results

(If you were wondering, Bing is largely insensitive to your travel.)

A Tool, a Hack, a Link, and a Site

booleanstrings Boolean Leave a Comment


David Galley and I are obsessed with tools, hacks, links, and sites. On our Slack, we have a channel called “Interesting Links” that gets populated nearly daily. Where do we get the info? Facebook Groups, Recruiting Brainfood Newsletter, shares in Messenger by colleagues, tweets with the hashtag #OSINT, RSS feeds from selected sources, and always, Googling. Once in a while, tool authors get in touch asking to be included in Tools.

Tool: SalesQL

Its target audience is sales, but it works wonders in our sourcing projects (combined with a few others). Not only does it guess contacts, providing a confidence rate – it can also grab many profiles from a search page or download your connections, and keeps results in exportable projects. Some functions are paid.

Hack: guess developer’s emails with more than 15% certainty (then verify).

It is not news that people often use one handle for social accounts and Gmail. The rate of right guesses vary. But – I ran an experiment on 16K+ GitHub handles (that we have collected). Then, I constructed the email guesses as <handle>@gmail.com. I uploaded the list to LinkedIn Recruiter – and got 15% matches! Given that more than half of GitHhub developers likely do not register the same email on GitHub and Linkedin, the true success rate is more like 30%. The selection, intentionally, was from a wide range of locations and languages.

Site: see many LinkedIn public profiles in Incognito

Why would you want to do so? Well – not to visit LinkedIn for any reason. Or, figure out which terms to put in your X-Ray searchGoogle’s Mobile Friendly Viewer.

Check out our Training Library – each class has many tips like the above.

These Keywords Are Not on the Job Description

booleanstrings Boolean 3 Comments

For leadership roles, a professional’s value is aligned with their ability to solve problems, thus allowing the company’s further growth. If a job description calls for a leader, you would be searching for profiles with keywords like leadership, growth, expansion, etc., synonymic to the words in the requirements. (Expect another post soon BTW.)

However, a true problem solver will also have keywords on his/her profile that are usually not in the job description. I am talking about “problem” (or negative) words describing difficult situations – that the person has helped solve. Here is an example (to be used on LinkedIn):

underperforming OR(destroyed) OR(losing) OR(loss) OR(lost) OR(declining) OR(failing) OR(fail) OR(“lack of”) OR(poor) OR(insufficient) OR(“did not meet”) OR(slow) OR(stalled) OR(behind) OR(failure) OR(decline) OR (outdated) OR(obsolete) OR(old) OR(broken) OR(inadequate) OR(“not enough”) OR(problem) OR(problems).

This search returns 26 MLN problem solvers! Unsurprisingly, tech giants lead in the numbers of solvers. Give it a try and let me know if it helps to uncover new results.

You can also use the string in Content search (combine the above with some keywords pointing to an industry or company) and find social shares from leaders.

(Can you think of some string additions? Please post in the comments.)

And this is where we humans beet the AI 😉

P.S. Do you own the 5th edition of the “Boolean Book”? There are 300 more searches there.

Three Topics? And Nine Tools

booleanstrings Boolean 3 Comments

Happy New Year, readers, and thanks for following my blog! What would you like me to write about? Please name three topics or questions of interest in the comments – thanks!

In the meantime, here is some recent news.

1. Google launches Question Hub – https://questionhub.withgoogle.com – to allow everyone to “answer” questions by submitting URLs. I imagine Google will be rolling these URLs out in its searches after some checking.

2. A Google algorithm called Smith claims to outperform BERT.

Due to both, we can expect Google to even better “understand” our queries.

3. Russian tool https://search4faces.com does a decent job of face recognition for look-alikes of members of Russian networks like VKontakte.

4. Another Russian tool https://go.mail.ru/search_social is like a CSE over Yandex. 

5. https://www.whatsmyname.app produces a list of over sixty social profiles for a username. (I have used it for our exam questions.)

6. Google search simulation from different locations. – this Chrome extension mimics searching from different locations and in different languages. Use it, varying the setting, to get many more results for a search than “your” Google shows, scrape, and combine results. Or, if you live in one country and source in another, “move” there temporarily.

7. Another way to get different results is by using Anonymized Google on https://www.startpage.com. The more, the merrier!

8. Switch to the old Facebook UI to be able to search across states or countries. (How? Paste a state page URL into the “location” field.)

9. LeadIQ Lead Capture seems to be one of the best contact finders.

Source on!

And please watch for our announcements – we will present a Tools class soon.