Beyond LinkedIn: OSINT, Data Mining And More!

Sourcing candidates on LinkedIn alone puts recruiters in competition with everyone else looking at the same profiles. A set of open-source intelligence techniques covers how to find resumes, contact lists and organizational information sitting in plain sight on Google's own products, along with tools that automate the collection and outreach process once those people are found.

Google Workspace documents are indexed publicly, and specific Boolean strings pull resumes and contact lists out of them:

• Using site:docs.google.com combined with intitle:(resume OR CV) and minus terms like -samples -jobs surfaces individual resumes posted as Google Docs.
• Adding /spreadsheets to that same site search, along with terms like contacts, attendees or participants, turns up conference lists and staff directories, and adding an email pattern like email **@gmail.com narrows results to documents containing addresses.
• Searching site:docs.google.com/presentation finds internal slide decks, including ones marked "confidential" that were never actually locked down, useful for both sourcing and competitive intelligence on organizational charts.
• Google Forms responses live in spreadsheets, so the same spreadsheet-based search syntax, not a forms-based one, pulls survey answers that include names and emails.
• Google Sites, the one-page portfolios many developers build instead of a formal resume, are searchable with inurl:cv or inurl:resume, an operator that doesn't work on other Google Workspace products. Usernames in those URLs often match the beginning of a person's work email address.

Programmable search engines (formerly Custom Search Engines) turn these Boolean strings into a reusable, shareable tool: specifying which sites to search, adding refinements to bypass the 100-result cap, and adding synonyms so a single search catches variant job titles or company names.

Once a list of candidates is found, several tools remove the manual work of opening each profile individually. Data Miner runs pre-built or custom "recipes" to pull names, locations, roles and emails from a batch of LinkedIn or Facebook profiles into a spreadsheet. Instant Data Scraper does the same job with a single click on any list page. PhantomBuster then automates the outreach itself, following or connecting with an uploaded list of prospects on Twitter or LinkedIn. AnyPicker, paired with an outreach tool, lets a recruiter manually mark which fields to extract from a profile once, then applies that pattern to an entire list before running an automated connection sequence.