> For the complete documentation index, see [llms.txt](https://tools.osintnewsletter.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://tools.osintnewsletter.com/osint-tools/maltego.md). # Maltego | **Maltego** | **Quick Overview** | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | URL | | | What it does | Collects and visualises information from multiple data sources, showing connections between entities such as people, companies, domains, IP addresses, social media accounts, and infrastructure. | | How to use it | Use either the web app or desktop version to create a graph, add entities, run transforms to gather information, and analyse relationships between results. | | Cost | Free Community Edition available with limitations. Paid professional and enterprise subscriptions available. | | Account required | Yes. | | Cookies | Several cookies related to authentication, session management, consent tracking, and security. | | Ownership | Acquired in 2023 by US-based private equity firm Charlesbank Capital Partners. | | Use in Reporting | Great for visualising relationships, investigative findings, attack infrastructure, and network connections. | ### What does Maltego do? Rather than presenting information as a list of search results, Maltego displays data as an interactive graph. This makes it easier to identify patterns, hidden connections, and relationships that might otherwise be missed. The platform works by using Transforms, which are automated queries that gather information from various data sources and expand the investigation outward from a starting point. **The lowdown:** Think of it as a giant digital whiteboard for investigations. ### How to Use: **1. Open Maltego on your desktop or via the web app and start a new graph.** **Note:** This is what it looks like on the web app. **2. Choose an entity that matches your starting point, such as a domain, email address, or company.** The below is how Maltego looks on the desktop version: **3. Right-click on your starting entity and select one or more relevant Transforms.** (Transforms are automated lookups that query data sources and return related information.) **4. Analyse relationships and expand the investigation. Continue running Transforms against newly discovered entities to expand your investigation further and watch your graph grow.** ### Cost * [ ] Free * [x] Partially Free * [ ] Paid Free Community Edition available with limitations. Paid professional and enterprise subscriptions available. ## Data Processing ### Account Required: * [x] Yes * [ ] No ### Cookies: Maltego sets several cookies related to authentication, session management, consent tracking, and security. Key cookies include CSRF protection tokens, OAuth authentication cookies, and session cookies used to maintain logged-in access. The platform also records referrer information for traffic attribution purposes. ### Use in Reporting Useful reporting outputs for Maltego include: * Relationship maps. * Infrastructure diagrams. * Domain ownership investigations. * Social network analysis. * Threat actor infrastructure mapping. * Corporate connection analysis. * Attribution support diagrams. As a real-world example, the [Cyber Police Department of Ukraine](https://www.maltego.com/blog/case-study-ukrainian-cyber-police-fights-crime-with-maltego/) has publicly stated that it uses Maltego in criminal investigations involving cybercrime, fraud, social network analysis, suspect profiling, and infrastructure tracing. The organisation reports using the platform to analyse digital traces across the surface web and dark web. | **Capabilities** | **Limitations** | | ------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------- | | Visualises complex relationships between people, organisations, domains, IP addresses, emails etc. through interactive graphs. | Many advanced features, data sources, and higher usage limits require a paid subscription. | | Automates data collection via Transforms, reducing the need for manual searches across multiple sources. | Results depend on the quality, availability, and accuracy of underlying data sources. | | Integrates with numerous OSINT & commercial data providers to enrich investigations. | Large and complex graphs can become difficult to interpret without experience. | | Ability to export graphs, document findings, and create professional visual reports. | Relationships shown with a graph indicate associations, not proof of ownership, identity or malicious activity. | ### Summary Maltego is usually most valuable during the analysis and correlation stage of the OSINT workflow. Whilst there is a learning curve, the platform can dramatically improve the efficiency and effectiveness of complex investigations by transforming scattered information into clear, visual intelligence. ### Ownership Maltego is owned by [Charlesbank Capital Partners](https://www.kirkland.com/news/press-release/2023/04/kirkland-advises-charlesbank-capital-partners-on-acquisition-of-munich-based-maltego), a US-based private equity firm. They acquired the Munich-based cyber security and big data analytics company in April 2023 through the Charlesbank Technology Opportunities Fund. ### Ethical Considerations * Only collect information for legitimate investigative purposes. * Avoid assuming that visual connections automatically indicate wrongdoing. * Consider legal and ethical implications when analysing personal information. * Use proportionality and necessity principles when conducting investigations. ### Related Tools: * SpiderFoot * theHarvester * Shodan * Hunchly #### Sources