If you are serious about OSINT and you are not using Yandex, you are leaving some of the most powerful free intelligence capabilities on the table. This is not an exaggeration. Professional investigators, law enforcement analysts, and intelligence researchers use Yandex regularly because it finds things that Google and Bing simply do not. This section goes deep. Pay attention.
Yandex is Russia's dominant search engine — the equivalent of Google for the Russian-speaking world. Now if you know anything about Russia, you know it is currently one of the top hacking nations in the world. Founded in 1997, it currently holds roughly 60-65% of the search market share in Russia and is one of the top ten most visited websites on the internet globally.
Most Western users have never used it. Most Western security professionals have heard of it but do not know its full capabilities. This is a significant gap because Yandex is not just a Russian Google — it has fundamentally different technology in several areas that make it uniquely powerful for OSINT.
The three reasons Yandex matters for OSINT:
- It indexes content that Google does not — particularly from Eastern Europe, Central Asia, and the former Soviet states, but also from the broader web through different crawling priorities
- Its facial recognition technology is significantly more powerful than Google's for finding faces across different photos
- It indexes social networks and platforms that Google either does not index or indexes poorly — particularly VKontakte (VK), the largest social network in Russia with 100+ million users
Understanding all three of these gives you capabilities that no other free tool replicates.
Google optimizes for relevance to the majority of its users — which means English-language content from high-traffic Western websites dominates its index. Content that exists in smaller languages, on platforms with limited Western presence, or on sites with low incoming link counts gets deprioritized.
Yandex was built to serve the Russian-speaking internet first. This means its crawlers prioritize:
- Russian, Ukrainian, Belarusian, Kazakh, and other post-Soviet language content
- Platforms dominant in Eastern Europe (VK, Mail.ru, Odnoklassniki)
- Content from domains hosted in Eastern European and Central Asian infrastructure
- Forums, message boards, and community sites popular in these regions
The result is an index that overlaps significantly with Google for mainstream Western content but diverges dramatically for anything connected to Eastern Europe, Russia, or the platforms dominant there.
For OSINT this means: Any investigation involving targets with connections to Russia, Eastern Europe, or Central Asia is materially incomplete without Yandex. And even for purely Western targets, Yandex's different indexing priorities surface content that Google's algorithm actively deprioritizes.
Yandex has a reputation in the SEO community for indexing new content faster than Google in certain regions and content categories. For OSINT involving recent events, newly published content, or fast-moving situations, Yandex can surface content hours or days before Google indexes it.
This is one of the most practically significant differences. Yandex indexes VKontakte (VK) deeply and comprehensively. VK has over 100 million active users and is the dominant social network in Russia and many neighboring countries. Most of its content is publicly accessible and indexed by Yandex in ways that Google does not replicate.
For investigations involving Russian-speaking individuals, VK profiles indexed by Yandex provide:
- Real names (VK requires real names more strictly than most Western platforms)
- Profile photos (searchable through Yandex Images)
- Public posts and activity
- Connected friends and family members
- Workplace and education information
- Location data
Yandex supports its own operator syntax. Some operators are identical to Google. Many are unique to Yandex. All of them work as of 2026.
Works identically to Google and Bing.
site:targetdomain.com
site:*.targetdomain.com
site:vk.com "targetname"
The VK angle: Running site:vk.com "firstname lastname" in Yandex
returns VK profiles that match the name — with significantly more depth
and accuracy than running the same search in Google.
Yandex-specific. Searches for pages where the specified string appears
in the URL. More powerful than inurl: on other engines.
url:admin site:targetdomain.com
url:config filetype:xml
url:backup site:targetdomain.com
url:login filetype:php
Yandex equivalent of intitle:. Searches for text in the page title.
title:"index of" site:targetdomain.com
title:"login" url:admin
title:"phpMyAdmin"
title:"webcam" url:view
Yandex-specific equivalent of filetype:. Works identically but uses
MIME type terminology.
mime:pdf site:targetdomain.com
mime:xlsx "confidential"
mime:sql intext:"password"
mime:env intext:"DB_PASSWORD"
Both mime: and filetype: work in Yandex — use whichever you prefer.
Yandex-specific. Filters results by language with more granularity than any other search engine.
lang:ru "targetname"
lang:uk "targetcompany"
lang:en site:targetdomain.com
lang:de "targetcompany" filetype:pdf
Language codes follow ISO 639-1 standard:
ru= Russianuk= Ukrainianbe= Belarusiankk= Kazakhen= Englishde= Germanfr= Frenchzh= Chinesear= Arabic
This operator is indispensable for international investigations. Filtering by language surfaces content that is linguistically hidden from searchers who only operate in one language.
Yandex-specific. Filters results by date range with precise control.
# Results from a specific year
date:2024 "targetcompany" "breach"
# Results from a date range
date:20240101..20241231 site:targetdomain.com
# Results after a specific date
date:20250101.. "targetname"
The format is YYYYMMDD with .. for ranges. This is more precise than
Google's time filter tool because it can be combined directly with other
operators in a single query.
Yandex-specific. Similar to site: but matches the exact hostname
rather than domain and all subdomains.
host:www.targetdomain.com
host:admin.targetdomain.com
host:api.targetdomain.com
Use site: to cast wide across all subdomains. Use host: when you want
to restrict to a specific subdomain only.
Yandex-specific. Returns all results from a domain and all its subdomains.
Similar to site: but sometimes returns broader results.
domain:targetdomain.com
domain:targetdomain.com filetype:pdf
Yandex-specific. Finds pages that contain links to a specific URL.
Google's link: operator is dead. Yandex's inlink: still works.
inlink:targetdomain.com
inlink:targetdomain.com/specific-page
This shows you who is linking to a target — backlink analysis, partner discovery, and mention tracking without needing expensive SEO tools.
Yandex-specific. Finds pages where the specified text is used as link anchor text pointing to another page.
anchor:"targetcompany"
anchor:"target person name"
This reveals how other websites reference a target — what language and context they use when linking to them.
Yandex-specific. Reverse host search — finds all pages under a domain by searching the domain name in reverse order. Useful for finding all content under a specific top-level domain structure.
rhost:com.targetdomain.*
This is where Yandex separates itself from every other free tool available.
Google Images uses image similarity algorithms optimized for objects, scenes, and products. Facial recognition is not its primary strength.
Yandex built its image search with facial recognition as a core capability from early on — partly because its primary market demanded it for finding people across Russian social networks where real photos are common and profile pictures are typically genuine.
The practical result is that Yandex Images finds faces across different photos with significantly higher accuracy than Google Images. This is not a small difference. It is the difference between finding nothing and finding multiple linked accounts, old photos, and cross-platform profiles.
Different angles of the same face: Google Images struggles when the same person appears in photos taken at different angles, different lighting, or with different expressions. Yandex handles this significantly better.
Older and lower quality photos: Yandex matches faces across photo quality levels — finding a professional headshot match for a grainy candid photo, or matching a current photo to one taken years earlier.
Photos from Eastern European platforms: VK, Odnoklassniki, and Mail.ru photos are deeply indexed in Yandex Images. A face search in Yandex will surface VK profiles that Google Images never returns.
Modified photos: Slightly cropped, color-adjusted, or filtered versions of the same photo. Yandex's matching algorithm is more tolerant of modifications than Google's.
Method 1 — Direct upload:
- Go to
yandex.com/images - Click the camera icon in the search bar
- Upload the image or paste an image URL
- Review results — Yandex will show visually similar images AND its best guess at who the person is based on indexed sources
Method 2 — URL search:
https://yandex.com/images/search?rpt=imageview&url=IMAGE_URL_HERE
Replace IMAGE_URL_HERE with the direct URL of any publicly accessible image.
Method 3 — Search by image region: After uploading, Yandex lets you select a specific region of the image to search — crop to just the face, just an object, just a background element. This is powerful for:
- Isolating one person from a group photo
- Identifying objects or locations in a background
- Finding the source of a specific element in a composite image
This is the complete professional workflow for using Yandex Images in a people investigation:
Step 1 — Prepare the image. Crop tightly to the subject. If searching for a person, crop so the face fills most of the frame. Remove backgrounds where possible. The cleaner the subject isolation, the better the results.
Step 2 — Run the search.
Upload to yandex.com/images. Note the first page of results — Yandex
often shows the person's name as a suggested search term at the top if
it has high confidence in its identification.
Step 3 — Examine suggested searches. Yandex shows related search terms below the image results. These often include the person's name, their profession, or associated organizations — intelligence derived directly from Yandex's image index.
Step 4 — Filter by source.
Use the filter options to narrow results by image size, color, type, and
source domain. Filtering to site:vk.com shows only VK results. Filtering
to site:instagram.com shows only Instagram results.
Step 5 — Follow the links. Every result links to the page where that image appears. Follow each link — the page context often reveals more than the image itself.
Step 6 — Cross-reference. Take names, usernames, and any other data found in Yandex results and run them through Google, Bing, Sherlock, and the other tools in your stack.
A person uses a photo as their profile picture on an anonymous forum. The photo has no EXIF data. Running it through Google Images returns nothing.
Running it through Yandex Images returns:
- A VK profile using the same photo under a real name
- An Instagram account using the same photo
- A news article photo caption with a real name attached
From a single anonymous forum profile picture, Yandex has connected the anonymous account to a real identity with multiple cross-platform confirmation points. This is a real workflow that investigators use regularly.
VK is the most important social network for OSINT involving Russian-speaking individuals. It has features that Western investigators often do not know about:
VK requires real names more strictly than Facebook. Most VK profiles contain genuine identity information.
VK profiles are public by default. Unlike Facebook where privacy settings default to friends-only, VK profiles are often fully public — photos, posts, friends lists, check-ins, and all.
VK has a robust photo tagging system. People tag friends and family extensively. A single VK profile often links through photo tags to dozens of connected real identities.
Yandex dorks for VK:
site:vk.com "firstname lastname"
site:vk.com "targetname" "city"
site:vk.com "company name" "employees"
site:vk.com/id "targetname"
site:vk.com "phone number"
site:vk.com "email address"
VK direct search:
https://vk.com/search?c[section]=people&c[q]=SEARCHTERM
VK's own search is sometimes more current than Yandex's index. Use both — Yandex for breadth and historical data, VK's native search for current results.
Odnoklassniki — literally "classmates" in Russian — is another major Russian social network, particularly popular with older demographics. It has 70+ million users and is deeply indexed by Yandex.
site:ok.ru "targetname"
site:ok.ru "firstname lastname"
site:ok.ru "company name"
Odnoklassniki profiles frequently contain:
- Real full names
- Birth dates
- School and university history
- Employer history
- Home city and sometimes neighborhood
- Extensive photo albums with location information
Mail.ru Group operates several major Russian internet services including the email service, social network My World (myworld.mail.ru), and others.
site:mail.ru "targetname"
site:myworld.mail.ru "targetname"
For investigations involving Russian-speaking targets, the professional tool stack is:
| Tool | Purpose | URL |
|---|---|---|
| Yandex Search | Primary search engine | yandex.com |
| Yandex Images | Facial recognition and image OSINT | yandex.com/images |
| VK Search | Social network people search | vk.com/search |
| Search4Faces | Facial search specifically across VK | search4faces.com |
| FindClone | Facial recognition specifically for VK | findclone.ru |
| Maltego | Relationship mapping with VK transforms | maltego.com |
| OSINT Industries | Multi-platform people search | osint.industries |
FindClone deserves special mention. It is a facial recognition tool specifically built for searching VK profile photos. Upload a face photo and it searches across VK's photo database. It is frightening in its effectiveness and it is largely unknown outside of specialist OSINT circles.
Yandex Maps (maps.yandex.com) is a genuinely powerful OSINT tool that
most Western investigators completely ignore.
Panorama coverage in Russia and Eastern Europe: Yandex Maps has street-level panorama coverage (similar to Google Street View) that is significantly more current and comprehensive in Russia and Eastern Europe than Google Maps. For geolocation of photos from these regions, Yandex Maps is the correct tool — not Google Street View.
Business and organization database: Yandex Maps has an extremely detailed database of Russian businesses, organizations, government buildings, and points of interest — with user reviews, photos, operating hours, and contact information. For identifying locations seen in photos from Russia or researching organizations, this database is invaluable.
Historical panorama views: Similar to Google Street View's historical imagery, Yandex Maps often has multiple historical panorama captures — letting you see how a location looked at different points in time.
When geolocating a photo from Russia or Eastern Europe:
- Identify architectural style, vegetation, street signs, or other visual clues (see the geolocation section in Social Media Dorks)
- Use the clues to narrow to a region
- Open Yandex Maps and navigate to that region
- Switch to panorama view
- Navigate street-level to find matching visual elements
- Compare background details, building angles, and infrastructure
For Russian cities specifically, Yandex Maps panoramas are often the only reliable street-level imagery available — Google Street View coverage becomes sparse or outdated quickly outside major Russian cities.
# Everything indexed about a target domain
site:targetdomain.com
# All subdomains
site:*.targetdomain.com
# Sensitive files
site:targetdomain.com mime:pdf OR mime:xlsx OR mime:docx
# Open directories
title:"index of" site:targetdomain.com
# Login panels
title:"login" url:admin site:targetdomain.com
# Error pages
site:targetdomain.com intext:"Fatal error" OR intext:"Warning:"
# Recent content only
date:20260101.. site:targetdomain.com
# Find person across Russian platforms
"firstname lastname" lang:ru
"firstname lastname" site:vk.com OR site:ok.ru OR site:mail.ru
# Find person by email
"email@domain.com" lang:ru
"email@domain.com" site:vk.com
# Find person by phone
"+7XXXXXXXXXX" lang:ru
"8XXXXXXXXXX" site:vk.com
# Find person by employer
"company name" "job title" "firstname" lang:ru
# Find person across time
date:20200101..20221231 "targetname" lang:ru
date:20230101.. "targetname" lang:ru
One of Yandex's most powerful and underused capabilities is finding content about a target in languages you do not speak, then using Yandex Translate to read it.
# Find Russian content about a Western company
"company name" lang:ru
# Find Ukrainian content
"company name" lang:uk
# Find content from specific date ranges in target languages
date:20240101.. "targetname" lang:ru
The workflow:
- Run the dork in Yandex
- Find Russian/Ukrainian/other language results
- Click the translate option (Yandex offers inline translation)
- Or copy the URL into
translate.yandex.comfor full page translation
This surfaces investigative leads from content that is completely invisible to English-only searches on Google.
Russian paste sites and file hosting services are indexed by Yandex but not always by Google. Data leaks, breach dumps, and sensitive documents posted to Russian file hosting frequently appear in Yandex but not in Western search engines.
# Russian paste sites
site:pastebin.ru "targetdomain.com"
site:paste.ee "targetname" lang:ru
site:ghostbin.com "targetdomain.com"
# Russian file hosting
site:rghost.ru "targetdomain.com"
site:files.mail.ru "targetdomain.com"
# Searching for breach data
"targetdomain.com" intext:"password" lang:ru
"targetdomain.com" intext:"leaked" lang:ru
translate.yandex.com — Full document and webpage translation with support
for 100+ languages. For OSINT purposes it functions similarly to Google
Translate as a proxy — fetching pages through Yandex's infrastructure.
Yandex Disk is a cloud storage service similar to Google Drive or Dropbox. Public Yandex Disk folders are indexed by Yandex and searchable.
site:disk.yandex.ru "targetname"
site:disk.yandex.com "targetcompany"
Public Yandex Disk links have exposed corporate documents, personal files, and sensitive data in the same way that Google Drive public links have — but this vector is far less commonly checked by security teams.
Yandex Metrica is a web analytics service (competitor to Google Analytics). Websites using Yandex Metrica have a tracking pixel embedded. This is relevant for OSINT because Yandex Metrica data has appeared in several major data exposures — and organizations that use it for analytics are often those with Eastern European operations or audiences.
Yandex is not a backup search engine. It is not a novelty. It is a professional-grade intelligence tool with capabilities that no other free platform matches in specific areas:
- Facial recognition across VK and the broader web — better than Google
- Eastern European content — indexed far more comprehensively than Google
- VK and Russian social platform intelligence — the only engine that does this well
- Unique operators —
lang:,date:,inlink:,host:— no equivalents - Geospatial intelligence in Russia — Yandex Maps panoramas are unmatched
Running Yandex after Google and Bing is not extra work. For any serious investigation, it is the difference between a complete picture and a partial one.
by SudoChef · Part of the SudoCode Pentesting Methodology Guide