Maltego

Tool Description : A visual link analysis and OSINT platform to discover, map, & understand relationships between people, organisations, domains, emails, social media accounts, infrastructure & more.

Maltego

Quick Overview

URL

https://www.maltego.com/

What it does

Collects and visualises information from multiple data sources, showing connections between entities such as people, companies, domains, IP addresses, social media accounts, and infrastructure.

How to use it

Use either the web app or desktop version to create a graph, add entities, run transforms to gather information, and analyse relationships between results.

Cost

Free Community Edition available with limitations. Paid professional and enterprise subscriptions available.

Account required

Yes.

Several cookies related to authentication, session management, consent tracking, and security.

Ownership

Acquired in 2023 by US-based private equity firm Charlesbank Capital Partners.

Use in Reporting

Great for visualising relationships, investigative findings, attack infrastructure, and network connections.

What does Maltego do?

Rather than presenting information as a list of search results, Maltego displays data as an interactive graph. This makes it easier to identify patterns, hidden connections, and relationships that might otherwise be missed.

The platform works by using Transforms, which are automated queries that gather information from various data sources and expand the investigation outward from a starting point.

The lowdown: Think of it as a giant digital whiteboard for investigations.

How to Use:

1. Open Maltego on your desktop or via the web app and start a new graph.

Note: This is what it looks like on the web app.

2. Choose an entity that matches your starting point, such as a domain, email address, or company.

The below is how Maltego looks on the desktop version:

3. Right-click on your starting entity and select one or more relevant Transforms. (Transforms are automated lookups that query data sources and return related information.)

4. Analyse relationships and expand the investigation. Continue running Transforms against newly discovered entities to expand your investigation further and watch your graph grow.

Cost

Free
Partially Free
Paid

Free Community Edition available with limitations. Paid professional and enterprise subscriptions available.

Data Processing

Account Required:

Cookies:

Maltego sets several cookies related to authentication, session management, consent tracking, and security.

Key cookies include CSRF protection tokens, OAuth authentication cookies, and session cookies used to maintain logged-in access. The platform also records referrer information for traffic attribution purposes.

Use in Reporting

Useful reporting outputs for Maltego include:

Relationship maps.
Infrastructure diagrams.
Domain ownership investigations.
Social network analysis.
Threat actor infrastructure mapping.
Corporate connection analysis.
Attribution support diagrams.

As a real-world example, the Cyber Police Department of Ukraine has publicly stated that it uses Maltego in criminal investigations involving cybercrime, fraud, social network analysis, suspect profiling, and infrastructure tracing. The organisation reports using the platform to analyse digital traces across the surface web and dark web.

Capabilities

Limitations

Visualises complex relationships between people, organisations, domains, IP addresses, emails etc. through interactive graphs.

Many advanced features, data sources, and higher usage limits require a paid subscription.

Automates data collection via Transforms, reducing the need for manual searches across multiple sources.

Results depend on the quality, availability, and accuracy of underlying data sources.

Integrates with numerous OSINT & commercial data providers to enrich investigations.

Large and complex graphs can become difficult to interpret without experience.

Ability to export graphs, document findings, and create professional visual reports.

Relationships shown with a graph indicate associations, not proof of ownership, identity or malicious activity.

Summary

Maltego is usually most valuable during the analysis and correlation stage of the OSINT workflow. Whilst there is a learning curve, the platform can dramatically improve the efficiency and effectiveness of complex investigations by transforming scattered information into clear, visual intelligence.

Ownership

Maltego is owned by Charlesbank Capital Partners, a US-based private equity firm. They acquired the Munich-based cyber security and big data analytics company in April 2023 through the Charlesbank Technology Opportunities Fund.