Maltego

Technical capabilities

Maltego is a graph-based open-source intelligence (OSINT) platform. It performs entity resolution and relationship discovery across a marketplace of data-source “Transforms” that enrich entities (people, organizations, domains, IP addresses, hashes, social-media accounts, phone numbers) with related entities. The graph interface enables analysts to navigate large investigative datasets visually.

The platform supports community-built and commercial transforms. Commercial integrations include OCCRP Aleph, ICIJ Offshore Leaks, Have I Been Pwned, Shodan, VirusTotal, Recorded Future and dozens of others. Maltego is a routine fixture in investigative journalism, threat intelligence and digital-forensics curricula.

Documented use

• Investigative journalism: Bellingcat, the Organized Crime and Corruption Reporting Project (OCCRP), the International Consortium of Investigative Journalists (ICIJ), and Forbidden Stories’s open-source investigators use Maltego routinely.
• Threat intelligence: integrated into incident-response workflows in commercial SOCs.
• Government and law-enforcement: confirmed customers include US federal agencies and Western European intelligence services.
• Academic and civic technology: Maltego is taught in SANS Institute curricula and is widely used in academic OSINT research.

Unlike most entries in this database, Maltego’s role is dual-use: the same product underpins consequential human-rights investigations and routine commercial threat work. Documented misuse against journalists or activists is limited in public reporting.

Customer states

Maltego is sold globally to law-enforcement, intelligence, defense, corporate investigations and civilian researchers. The community edition (Maltego CE) is free and used by tens of thousands of investigators worldwide. Commercial licenses (Maltego Pro, Enterprise) are restricted by export-control review under German and EU dual-use regulation since the 2020 acquisition by Maltego GmbH.

Legal and sanctions status

• Not on the US Department of Commerce Entity List.
• Not designated by US OFAC.
• Subject to EU dual-use export controls (Regulation 2021/821) since the 2020 corporate transition to German domicile.
• No documented criminal proceedings against vendor staff.

Technical countermeasures

• Compartmented digital identity: Maltego is most effective when an investigator can pivot from one identifier (email, phone, username) to another. Distinct identifiers across activist, professional and personal contexts blunt this.
• Pseudonymous accounts on sensitive workflows: for sources, whistleblowers and activists, dedicated pseudonyms with no real-name link disrupt graph traversal.
• Have I Been Pwned monitoring: routinely check whether your credentials surface in breach corpora. Maltego transforms heavily rely on breach-data linkage.
• Domain and registration hygiene: WHOIS, certificate-transparency, and passive-DNS sources are core transform inputs. Use privacy-protected registrations and short-lived domains for sensitive operations.
• Public social-media review: reduce explicit cross-references that enable easy entity correlation.

There’s no perfect setup. Anyone selling you perfect is selling fear. The goal is simple: make yourself a harder target than the person next to you.