Whether your cameras currently use or a VPN for remote access.
Some argue that if a device is broadcasting on a public IP with no authentication, it is, by definition, public. The camera owner has chosen (through negligence) to publish the feed. Security researchers use dorks like this to highlight the scale of the problem.
This specific dork targets legacy network cameras, primarily those manufactured by Panasonic and Axis, which used a distinct URL structure for their web-based viewing portals. Here is what each component of the string means:
Go into your camera’s web interface (often via the same viewerframe page, but from inside your network) and ensure that "Allow anonymous access" or "Public view" is unchecked. Require a username and password for every video stream. inurl viewerframe mode motion upd
At first glance, this string looks like technical gibberish. But to those in the know, it represents a direct gateway into unsecured webcams, security cameras, and surveillance systems broadcasting their feeds to the open web. This article provides an exhaustive exploration of this search query—what it means, how it works, the ethical and legal implications, and how to protect yourself if your equipment uses these parameters.
While Google only indexes web pages (port 80/443/8080), specialized search engines like (which scans all ports) made matters worse. Shodan can find cameras on non-standard ports like 32015, 37777, or 554 (RTSP). The inurl:viewerframe mode motion upd query works best on traditional web search engines, but Shodan users often combine it with filters like port:80 to find live feeds directly.
However, the query remains highly effective against , such as: Whether your cameras currently use or a VPN
You can proactively audit your own network security. Run a Google search for your own public IP address using the inurl: operator, or use specialized IoT search engines like Shodan and Censys to verify that your network ports are tightly closed to the public.
Подключаемся к камерам наблюдения - Habr
This points directly to the older web-server page architecture ( ViewerFrame?Mode=... ) used by Axis devices to render live video streams in a browser. Security researchers use dorks like this to highlight
If you need instructions on ?
"inurl viewerframe mode motion upd" appears to be a composite of URL tokens and parameters tied to embedded viewers, presentation modes, motion-related content, and update markers. The phrase is useful for discovery and security auditing but must be used ethically and legally.
'site:' , restricts search to a specific domain. 'filetype:' , searches for files of a specific type (PDF, DOCX, etc) 'intitle:' , Texas A&M University Geocamming — Unsecurity Cameras Revisited - Hackaday