How to Use Maltego for OSINT Investigations: A Beginner Tutorial

Key takeaways

• Maltego is commercial software with a free Community Edition. It is not open source.
• The workflow is always the same: pick an entity, run a transform, read the new entities, repeat.
• Practise on your own domain or a lab target. Investigating people or companies without a lawful purpose can breach privacy law.
• Maltego shows relationships. It does not prove them, so verify every link from a second source.

What does Maltego do?

Maltego is a graph tool. A normal search tool gives you a list of results. Maltego gives you a picture of how things connect: a domain points to an IP address, that address hosts other domains, those domains share a name server, and so on. Investigators use this to map an organisation's internet footprint, trace infrastructure behind a phishing campaign, or link accounts and email addresses.

One correction to a common claim: Maltego is not open source. It is a commercial product from Maltego Technologies with a free Community Edition that has usage limits. Check the official Maltego site for the current edition comparison before you plan a project around it.

The three ideas you need

• Entity: one piece of data on the graph, such as a Domain, IPv4 Address, Email Address, Person, Website or Phone Number.
• Transform: a small query that takes an entity and returns related entities. "Domain to IP address" is a transform. Transforms come from the built-in set or from data partners in the Transform Hub, and some partner sources need their own account or API key.
• Graph: the canvas where entities and links accumulate. You can lay it out as blocks, hierarchy or organic clusters.

Install and set up

1. Download Maltego from the official site for Windows, macOS or Linux. On Kali Linux it is often already present; check the Kali documentation for the current package.
2. Choose the Community Edition when asked and register a free account. Maltego needs a login to run transforms.
3. Open the Transform Hub and install the standard transforms. Add partner data sources only if you have a reason and the terms allow your use.
4. Create a new graph from the first screen.

A safe first investigation

Use a domain you own, or one you have written permission to analyse. Do not start with a company you are curious about.

1. Drag a Domain entity from the palette onto the graph and set its value to your domain.
2. Right-click it and run the DNS transforms. You should see name servers, mail servers and IP addresses appear as new entities linked to the domain.
3. Select an IP address entity and run a transform that resolves it back to other domain names. On shared hosting you will see unrelated sites, which is a useful lesson: sharing an IP address does not mean sharing an owner.
4. Run a website or technology transform on the domain to see what the public site reveals.
5. Select everything and use the layout options, then save the graph so you can reopen it.

Now read it as an analyst. Which entities did you expect? Which surprised you? A mail server you forgot about, or an old subdomain pointing at a retired server, is exactly the kind of finding a defender wants to see first.

Reading the graph without fooling yourself

• Links show relationship, not proof. Two domains on one IP may have nothing to do with each other.
• Check dates. DNS and WHOIS data can be stale. Note when each fact was collected.
• Keep a source for every claim. If you cannot say where a link came from, remove it from your report.
• Pivot carefully. Each transform multiplies results. Pick the entities that matter and delete noise.

What are the Community Edition limits?

The free edition limits how many results a transform returns and is intended for non-commercial use, so it suits learning and small checks. Professional work on a client engagement normally needs a paid edition. Read the current licence terms on the Maltego site, because plans change.

What are the legal and ethical rules?

Collecting public information is lawful in most cases, but how you use it still matters. In India, accessing systems without permission is an offence under the Information Technology Act, 2000, and personal data is now covered by the Digital Personal Data Protection Act, 2023. For authorised security work, get written scope first. For investigations involving people, have a lawful and proportionate purpose. If you find evidence of a crime, report it through the national portal at cybercrime.gov.in rather than acting on your own.

Common mistakes

• Running every transform on every entity and drowning in results.
• Treating a graph screenshot as evidence without recording sources and timestamps.
• Investigating individuals for personal reasons.
• Using partner data sources without reading their terms.

Next steps

Build a small OSINT lab first: the OSINT virtual machine setup guide shows a clean base to work from, and the overview of Maltego's features goes deeper on what it can do. If you want structured training in reconnaissance within a full ethical hacking path, see the CEH v13 AI course.

Related reading

• Hunchly OSINT Tool | How to Capture, Preserve, and Organize Digital Evidence for Online Investigations
• Wireshark | The Ultimate Network Protocol Analyzer for Beginners