Maltego is an OSINT and link analysis platform originally developed by Paterva, a South African company founded in 2008, and now operated by Maltego Technology GmbH headquartered in Munich, Germany. The platform provides investigators with a visual graph environment for collecting, transforming, and analysing information from public web sources, commercial data feeds, and custom integrations. Maltego is used by law enforcement, intelligence, corporate security, and journalistic investigators globally. The product is available in free Community Edition, paid Pro and Enterprise editions, and a Classroom edition for academic use.
What it means in practice
Maltego operates on the principle of transforms: small programs that take an input data point (such as a domain name, email address, or phone number) and return related data points (such as DNS records, associated email addresses, or known phone owners). Investigators chain transforms together to expand from a single starting point into a graph of related entities. The platform integrates with hundreds of data sources through commercial transforms, and supports custom transforms for organisations with their own data sources or analytical methods.
Specific things to know
Maltego’s market position is differentiated from other OSINT platforms by its visual analytical approach and its breadth of integrations. The platform has been used in journalism investigations covering surveillance contractors, financial fraud, organised crime, and political corruption. Notable investigative outlets including OCCRP, ICIJ, and Bellingcat have used Maltego in major reporting projects. The 2020 acquisition of Paterva by the Munich-based holding company moved the corporate registration into the EU, which has implications for data protection compliance under GDPR.
Change today
If you are subject to potential OSINT investigation, the operational answer is to recognise that Maltego-class tools make it cheap to enumerate the connections between data points you have published online. The defensive baseline is operational compartmentation: separating identities, contact details, and operational contexts so that aggregating one set of data points does not reveal another. Using different email addresses for different contexts, separate phone numbers for separate identity layers, and disciplined posting hygiene across social media accounts reduces the aggregate analytical surface available to a Maltego user investigating you.
Related articles
See our coverage of OSINT investigation methodology, the journalist use cases for Maltego-class platforms, and the operational defences for individuals seeking to maintain compartmented digital identities.