| Guide | GDE-018 |
| Topic | Maltego OSINT |
| Domain | Digital infrastructure |
| Last updated | August 2026 |
Short answer: Seed the graph with a known entity, run transforms to expand it, and read the resulting network for meaningful clusters.
What is Maltego?
Maltego is a link-analysis platform that represents an investigation as a graph of entities, such as domains, people, email addresses and companies, connected by transforms that query external data sources and add new linked entities automatically. It answers how disparate pieces of evidence relate to each other visually, rather than requiring an investigator to hold every connection in their head.
Where most OSINT tools return a list of results, Maltego builds those results as nodes on a graph and draws edges between them, letting an investigator see a network of relationships form as each transform runs. A domain entity can transform into its DNS records, which transform into hosting infrastructure, which transforms into other domains on the same server, all visible on one canvas.
Investigators use Maltego to map corporate structures, infrastructure relationships and social networks where the value lies in seeing the connections, not just the individual data points. The free Community Edition covers a substantial working set of transforms sufficient for most independent investigations.
| • | Mapping relationships between domains, IP infrastructure and organisations visually |
| • | Building a corporate structure graph from company registry and ownership data |
| • | Visualising a social network from email addresses, usernames and associated accounts |
| • | Presenting a complex investigation to stakeholders who need to see connections, not just a list of findings |
| • | Running the same transform set repeatedly across multiple targets to standardise a workflow |
How do you build an investigation graph in Maltego?
Seed the graph with a known entity, run transforms to expand it, and read the resulting network for meaningful clusters.
Free before paid. The Community Edition covers the workflow in this guide; the commercial tiers add transform volume limits removal and additional data integrations.
Maltego Community Edition: Free with registration. The desktop application used throughout this guide, with a working transform set covering DNS, WHOIS, social media and company data, subject to a per-transform results cap and a monthly credit allowance on the free Basic plan.
Maltego Transform Hub: Free and paid entries. A directory of additional transform integrations, some free with their own account and API key, others requiring a paid subscription to the underlying data provider.
Gephi: Free and open source. A complementary graph-visualisation tool for cases where a Maltego graph needs to be exported and re-analysed with different layout algorithms or for a larger node count than Maltego's interface comfortably handles.