Investigating with Maltego
A data visualization and analysis platform to map complex relationships in OSINT
Why Maltego for OSINT investigations?
The global reference for data visualization and link analysis
Visualisation
Interactive graphs to see relationships
Automation
Automated transforms for data collection
Multi-sources
Integration with hundreds of OSINT sources
Collaboration
Graph sharing and teamwork
Key features
Advanced capabilities for visual investigation
Interactive visual graphs
Visualize complex relationships between entities with dynamic, interactive and customizable graphs for intuitive visual analysis.
Powerful transforms
More than 300 built-in transforms to automate information gathering from many OSINT sources and enrich investigations.
Multiple data sources
Native integration with Shodan, VirusTotal, PassiveTotal, social networks, DNS, WHOIS and hundreds of other sources.
Extensibility
Build custom transforms in Python, Java or via a REST API to add your own data sources.
Team collaboration
Share graphs, machines and results with your team for real-time collaborative investigations.
Professional reports
Export graphs to PNG, PDF, GraphML or CSV for investigation reports and presentations.
Installation
Available editions
- Community Edition (free)
- Classic Edition (paid)
- XL Edition (paid)
Installation
- Visit the official Maltego website
- Create a free account
- Download the right edition
- Run the installer
- Configure your login details
Interface
Main components
- Graph area: shows entities and their relationships
- Palette: holds the available entities and transforms
- Detail view: shows information about the selected entity
- Toolbar: access to the main features
Creating graphs
Basic steps
- Create a new graph
- Add a starting entity
- Use transforms to uncover information
- Organize and analyze the results
Entity types
- Domains
- IP addresses
- Emails
- People
- Organisations
- Documents
Using transforms
Available transforms
- DNS Lookup
- Whois Information
- Social Media Search
- Email Address Lookup
- Company Information
Best practices
- Use transforms in a targeted way
- Check API limits
- Document your findings
- Organize results logically
Export and sharing
Export formats
- GraphML
- PNG
- CSV
Sharing graphs
- Export for presentations
- Sharing with the team
- Embedding in reports
Best practices
- Plan the investigation before you start
- Use consistent graph names
- Document your information sources
- Respect API limits
- Keep your graphs clearly organized
- Save your work regularly
Maltego entity types
Entity categories available for your investigations
Infrastructure
Domains, subdomains, IP addresses, servers, DNS records
People
Individuals, social profiles, digital identities
Organisations
Companies, organizations, legal entities
Documents & media
Files, documents, images, media
Social networks
Profiles, pages and accounts on social platforms
Geolocation
Locations, physical addresses, GPS coordinates
Essential transforms
Key transforms for OSINT investigations
DNS reconnaissance
To DNS Name
Full DNS resolution (A, AAAA, MX, NS, SOA, TXT)
To DNS Name - NS (name server)
Discover authoritative DNS servers
To DNS Name - MX (mail server)
Identify mail servers
WHOIS & Registrant
To WHOIS Info
Extract full WHOIS information
To Domains [Registrant Email]
Find other domains owned by the same registrant
To Person [WHOIS]
Extract the registrant from WHOIS
Social networks
Search Twitter
Search Twitter mentions and profiles
To LinkedIn Profile
Find professional LinkedIn profiles
Search Facebook
Search Facebook profiles and pages
Threat Intelligence
To VirusTotal Report
Reputation analysis and malware detection
To PassiveTotal
Historical DNS and WHOIS records
To Shodan
Information on services and vulnerabilities
Investigation workflows
Practical Maltego scenarios
Domain investigation
Full mapping of a domain's infrastructure
Detailed workflow
Add the domain
Drag a Domain entity onto the graph
DNS Enumeration
Transform: To DNS Name - NS/MX/A records
Subdomains
Transform: To DNS Name [subdomain]
IP Resolution
Transform: To IP Address
WHOIS Info
Transform: To WHOIS Info
Infrastructure map
Organize and analyze the results
Person profiling
In-depth investigation of a person
Detailed workflow
Starting email
Initial Email Address entity
Social media
Transform: Search social networks
Associated domains
Transform: To Domains
Phone numbers
Transform: To Phone Number
Professional info
Transform: To Company/LinkedIn
Network analysis
Analyze connections and relationships
Threat intelligence
Malicious infrastructure analysis
Detailed workflow
Initial IOC
Malicious IP or domain
VirusTotal
Transform: To VirusTotal Report
PassiveTotal
Transform: Historical WHOIS/DNS
Related infrastructure
Pivot to related infrastructure
Attribution
Look for patterns and attribution
Timeline
Rebuild the attack timeline
Maltego machines
Advanced automation of investigation workflows
Reconnaissance machines
Automated information gathering
Person investigation
In-depth people investigation
Infrastructure mapping
Network infrastructure mapping
Custom machines
Build custom machines
Best practices
Recommendations for effective investigations
Do
- Plan the investigationDefine objectives and scope before you start
- Organize your graphsUse layouts and colors for visual clarity
- Document sourcesRecord the transforms used and collection dates
- Use machinesAutomate repetitive workflows with machines
- Save regularlySave graphs and export to GraphML
- Validate the dataCheck information against multiple sources
Avoid
- Overly complex graphsAvoid graphs with more than 500 entities
- Ignoring API limitsRespect external service quotas
- Skipping validationNever accept results without checking them
- Forgetting confidentialityProtect sensitive investigation data
- Lacking structureAlways follow a clear methodology
- Ignoring the lawRespect the law and obtain the necessary authorizations
Installation and getting started
Maltego installation guide
Create a Maltego account
Visit maltego.com and create a free account
https://www.maltego.com/ce-registration/Choose your edition
- Community Edition (CE) - Free, limited
- Classic - Paid, 10,000 entities
- XL - Paid, unlimited + collaboration
Download and install
- Download for Windows, macOS or Linux
- Run the installer
- Sign in with your Maltego account
- Configure the transform hubs
Your first graph
- Create a new graph
- Drag a Domain entity from the palette
- Right-click → Run Transform → To DNS Name
- Explore the results visually
Legal considerations and API limits
Maltego is a powerful tool that queries many data sources. Make sure you have the authorizations your investigations require and respect the limits of the APIs you use.
Watch out for:
- Transforms consume API quotas (VirusTotal, Shodan, etc.)
- Get written authorization for investigations
- Comply with GDPR and privacy laws
- Pentest use requires a contract and a defined scope
Resources and documentation
Useful links to go further
Ready to visualize your investigations?
Discover other OSINT tools and sharpen your visual investigation techniques
Ready to put it into practice?
CyberXTEL is our free platform to train hands-on: certifications, CTFs and a dedicated cyber awareness space.