Check your camera’s settings. Look for an option labeled "Anonymous Viewer" or "Public Access." Disable it. The /viewerframe page should always prompt for a username and password.
Google now relies heavily on JavaScript rendering and canonical tags. The parameter ?mode=motion is largely ignored by modern crawlers because it leads to dynamic, duplicate content. Consequently, inurl:viewerframe only catches the oldest, most static pages left on the web.
Modern IP cameras (and modern browsers) require HTTPS. They also refuse to display a live stream without logging in. The viewerframe dork relies on HTTP basic authentication or no authentication at all. Today, if a camera is exposed, it usually sits behind a login screen that Google cannot crawl.
Let’s look at the historical results of this dork. In its heyday (circa 2010-2015), a user might have found three distinct categories of feeds:
While inurl:viewerframe mode motion alone will return thousands of cameras (living rooms, garages, parking lots), adding "bedroom" changes the severity from "curious" to "voyeuristic."
Security researchers classify this specific search string as a High-Risk Privacy Violation Vector.
When a user types inurl:viewerframe mode motion bedroom into Google (or another search engine with dorking capabilities), the search engine returns a list of unsecured, live-streaming IP cameras.
Why does this happen?
The result is terrifying: A stranger can click a link in Google and see a live video feed of a stranger’s bedroom, including the bed, sleeping occupants, children, or private activities.