The search query inurl:viewerframe?mode=motion is a well-known Google dork
used to find live, publicly accessible webcams on the internet—most commonly those manufactured by Axis Communications What This Query Does
: This operator tells Google to look for specific text within the URL of a website. viewerframe?mode=motion
: This specific string is part of the default URL path for Axis network camera web interfaces.
: When used together, Google returns a list of active cameras that are currently streaming video directly to the web without password protection. Why This Happens Many IP cameras are installed with default settings
that allow public access if a password isn't specifically set during installation. This allows anyone with the right search query to view the live feed, which may include private offices, warehouses, or public spaces. www.opentech.fund Related Camera Dorks
Security researchers and curious users often use similar strings to find different types of cameras or server interfaces: intitle:"Live View / - AXIS" : Targets the page title of Axis cameras. inurl:/view.shtml : Another common extension for Axis camera live views. inurl:axis-cgi/mjpg
: Specifically looks for cameras streaming in Motion-JPEG format. How to Secure Your Own Camera
If you own an IP camera and want to ensure it is not indexed by search engines: Change Default Credentials
: Never leave the admin username and password as "admin/admin" or "root/pass". Enable Authentication
: Ensure that the "anonymous viewing" or "guest access" feature is disabled in the camera's network settings.
: Instead of exposing the camera directly to the internet (Port Forwarding), access it through a secure VPN or an encrypted cloud service provided by the manufacturer. www.opentech.fund further or find information on modern encrypted camera brands OTF | Supporting Internet Freedom Worldwide
This phrase is a classic "Google Dork." It helps people find unsecured, live security cameras around the world. Usually, these are Pan-Tilt-Zoom (PTZ) cameras that use Axis Communications software.
Because the settings aren't password-protected, anyone who finds the link can watch the feed and even move the camera. What is "inurl:viewerframe?mode=motion"?
The term is a search operator. It tells Google to look for specific text within a website's URL.
inurl:: Restricts results to URLs containing the following string. viewerframe: A common directory for Axis network cameras.
mode=motion: This specific mode displays a live MJPEG stream that refreshes quickly, making it look like real video. Why Are These Cameras Public?
Most of these cameras aren't meant to be public. They end up on the open web for a few simple reasons:
Default Settings: Many installers plug them in and leave the default "no password" setting active. inurl viewerframe mode motion best
UPnP/Port Forwarding: Routers often automatically open "holes" to let the camera work remotely, unknowingly exposing it to Google's crawlers.
Lack of Updates: Older firmware might have security bugs that bypass login screens entirely. The Risks of Open Feeds
Finding these cameras might feel like a harmless hobby, but it highlights a massive privacy gap.
Privacy Invasion: Feeds often show private backyards, office interiors, or retail stockrooms.
Physical Security: If a thief can see your camera feed, they know exactly when you aren't home.
Bandwidth Hijacking: Thousands of people "pinging" a private camera can crash the local network. 🛡️ How to Secure Your Own Camera
If you own an IP camera, you don't want it showing up in these search results. Take these steps:
Change Default Passwords: Never use "admin/admin" or "1234."
Update Firmware: Manufacturers release patches to block these search indexing vulnerabilities.
Disable UPnP: Manually manage your router's port forwarding.
Use a VPN: Access your home network through an encrypted tunnel instead of opening the camera to the internet. The Ethics of "Dorking"
While using search operators is legal, interacting with private systems can cross legal lines depending on your location. Most "viewers" are just curious, but the existence of sites like Shodan or Insecam shows how easily our private lives can become a public broadcast if we don't lock the digital door.
To help you secure your specific setup, what brand of camera or router are you currently using?
inurl:viewerframe?mode=motion is a well-known Google Dork , a specialized search string used to locate publicly accessible (and often unsecured) network cameras on the internet. Overview of the "Dork"
Google Dorks leverage advanced search operators to find specific strings within a website’s URL, title, or body text. This specific query targets the web interface of certain IP cameras (often manufactured by
Tells Google to look for the following text specifically within the site's URL. viewerframe?
: A common file or directory name used by older network camera web portals. mode=motion
: Instructs the camera’s web interface to display the live feed in a specific viewing mode, typically one that refreshes based on motion or uses a motion-JPEG (MJPEG) stream. Why This Works The search query inurl:viewerframe
Many network cameras are connected to the internet without proper password protection or are left with factory default credentials
(like "admin" or "1234"). When Google’s crawlers index these unprotected web interfaces, they become searchable by anyone using these dorks.
What is Google Dorking/Hacking | Techniques & Examples - Imperva
The query "inurl:viewerframe?mode=motion" is a well-known Google Dork used to find live web interfaces for older network cameras, primarily those manufactured by Panasonic. These cameras use a specific web-based viewer that allows users to monitor live feeds and control camera settings directly from a browser. Key Features of "Viewerframe" Mode
Mode Settings: The mode=motion parameter specifically tells the camera's web server to stream video using a method that updates frames only when movement is detected or at a specific interval to save bandwidth.
Interactive Controls: These interfaces often include "viewer frames" that provide access to PTZ (Pan-Tilt-Zoom) controls, allowing remote users to move the camera or zoom in on specific areas.
Resolution & Performance: Depending on the model (e.g., Panasonic BL-C10 or WJ-NT104), these cameras typically offer resolutions ranging from 720p up to newer 4K versions, with frame rates generally between 15 and 30 fps. Technical Optimization (Best Settings)
To get the most out of these legacy interfaces, users often apply specific URL modifications:
Refresh Mode: If mode=motion fails to load or is sluggish, changing it to mode=refresh in the URL can force a more consistent image update.
Interval Control: Adding &interval=30 (or another numerical value) to the end of the URL allows you to manually set how often the frame updates, which is helpful for slow connections.
Motion Detection Setup: For cameras used in security setups like Motion (an open-source CCTV software), you must specify the JPEG image path (e.g., netcam_url http://camera_ip/jpg/image.jpg) in the configuration file to allow external software to capture and analyze the feed for movement. Security & Privacy Warning WorkingDevices < Motion < Foswiki
Before providing the guide, a critical warning is necessary:
⚠️ Legal and Ethical Notice Accessing video feeds from cameras you do not own or have explicit permission to view is illegal in most jurisdictions (Computer Fraud and Abuse Act in the US, similar laws globally). This guide is for educational purposes only—to help system administrators secure their devices, or for ethical penetration testing with written authorization. Unauthorized access can lead to criminal charges, fines, and imprisonment.
Put together, inurl:viewerframe mode motion searches for web pages that:
The word "best" is your modifier. When appended to the search (e.g., "best inurl:viewerframe mode motion"), it implies you are looking for the highest quality streams, most active cameras, or most reliable connections.
If you are a security professional or system administrator:
You could use this dork to:
Example search on Google (for testing only with proper authorization): ⚠️ Legal and Ethical Notice Accessing video feeds
inurl:viewerframe mode motion
Expected results: URLs like
http://xx.xx.xx.xx/viewerframe?mode=motion
The search string inurl:viewerframe mode motion looks for web pages where:
viewerframe appears in the URL – often part of camera live view interfaces.mode=motion indicates the camera is set to show motion-triggered footage or motion detection view.This is a Google dork – a search operators combination used for finding specific technology on the web, sometimes unintentionally exposed.
Most of these cameras use Java or ActiveX. Modern browsers block Java.
To move beyond the basic dump and find quality streams, you need to combine the dork with other operators.
1. Finding High-Resolution (HD) Feeds
Add stream or 720p or 1080 to the query:
inurl:viewerframe?mode=motion 1080p
2. Finding Active (Live) vs. Dead Feeds
Add a date filter using Google Tools. Also, add terms like datetime or timestamp to ensure the camera clock is running.
inurl:viewerframe?mode=motion "2024"
3. Finding Publicly Safe Feeds (Ethical Viewing)
Add weather or square or traffic to find cameras intended for public use.
inurl:viewerframe?mode=motion "live traffic"
4. Finding Specific Manufacturers
While viewerframe is generic, some cameras use unique strings. For Blue Iris software:
inurl:viewerframe?mode=motion "Blue Iris"
Before we discuss finding the "best" sources, we must break down the syntax.
inurl: : This is a Google search operator that tells the search engine to only return results where the specific text appears inside the URL.viewerframe : This refers to a specific file or script used by older web-based CCTV interfaces (often manufactured by vendors like Hikvision, Dahua, or Trendnet).mode=motion : This parameter tells the camera’s web server to display the feed in motion detection mode.The Result: When you combine these, you are asking Google to list every unsecured IP camera web interface that uses this specific software architecture. Because these cameras lack proper authentication (username/password authentication is disabled or still set to "admin/admin"), Google indexes them just like any other webpage.
Check if your cameras are exposed:
inurl:viewerframe mode motion site:yourdomain.com or ip:your.public.ip.rangeIf found, take immediate action:
/viewerframe via .htaccess or firewall rules.