Maltego

Background

Maltego is a link-analysis and open-source intelligence (OSINT) software platform that lets investigators graphically map relationships between real-world entities such as people, email addresses, domains, IP addresses, social media profiles, phone numbers, and organizations. The tool was originally developed by Paterva, a company whose branding and identity were later folded into Maltego Technologies GmbH, headquartered in Munich, Germany. The official Paterva domain now redirects visitors directly to maltego.com, reflecting this consolidation under the Maltego brand.

How it works

Maltego organizes information into "entities" (a person, a domain, an email address, a piece of infrastructure, and so on) and connects them into a visual graph. Data is pulled in through "transforms" -- modular queries that reach out to search engines, DNS records, WHOIS data, social networks, and other public or commercial data sources -- and the results are rendered as nodes and links so an analyst can visually trace connections that would be difficult to spot in raw text or spreadsheets. Kali Linux, one of the most widely used penetration-testing distributions, describes Maltego on its official tools page as "an open source intelligence and forensics application" and ships it by default as part of its information-gathering, reporting, and social-engineering toolsets.

Product evolution

Over time, the single desktop application expanded into a broader platform. According to Maltego's own website, the current product line includes Maltego Graph (the core desktop and browser-based link-analysis client, available in a free Community Edition as well as commercial tiers), Maltego Search (a quick OSINT lookup tool for emails, aliases, phone numbers, and domains), Maltego Monitor (real-time social media monitoring), Maltego Evidence (collection and preservation of social media evidence), and Maltego Data (curated OSINT and commercial data access), along with case-management and administration features aimed at teams and enterprise investigators.

Adoption and use cases

Maltego is used across several overlapping communities: penetration testers and red teams use it during the reconnaissance phase of an engagement to map an organization's external footprint; cyber threat intelligence analysts use it to pivot between indicators such as domains, IP addresses, and malware infrastructure; and open-source (OSINT) investigators, journalists, and law-enforcement analysts use it to visualize relationships between people, accounts, and organizations. Maltego's own marketing materials state that the platform is used by more than 200,000 users worldwide, including over 2,000 government organizations and more than 4,000 private companies, and that a majority of Dow 30 companies use it in some capacity -- figures that reflect the vendor's self-reported scale rather than independently audited numbers.

Independent coverage and reception

Maltego has been referenced repeatedly in independent security and investigative journalism as one of the standard tools in the OSINT toolkit. In a 2022 survey of open-source researchers published by the investigative outlet Bellingcat, Maltego was rated the third most-favored and second most-helpful tool among respondents, who described it as a graphical link-analysis tool useful for identifying hidden connections between people or organizations and consolidating investigation data in one place; the same survey also recorded criticism from some respondents that the tool could be complex to set up and that its output graphs sometimes required significant rework to be presentable. Maltego has also been cited by outlets such as CSO Online in roundups of top open-source intelligence tools, and by organizations including Mandiant in threat-intelligence competency frameworks, underscoring its position as an established, if not universally loved, tool in professional investigative and security workflows.

Significance and legacy

Maltego's lasting significance lies in how it helped normalize graph-based, transform-driven link analysis as a mainstream technique in both offensive security reconnaissance and open-source investigation, rather than leaving analysts to manually correlate data from disparate sources. Its long-standing inclusion in Kali Linux exposed generations of penetration testers and security students to structured OSINT methodology, while its commercial evolution into a broader investigation platform (spanning monitoring, evidence collection, and curated data access) mirrors the wider professionalization of OSINT and threat-intelligence tooling in the cybersecurity industry.

Timeline

• 2000sMaltego is created by the company Paterva as a desktop application for graphical open-source intelligence and link analysis.
• 2010sMaltego becomes a default-included tool in the Kali Linux penetration-testing distribution, listed under information-gathering and OSINT categories.
• 2010s-2020sPaterva's branding is consolidated under Maltego Technologies GmbH, based in Munich, Germany; the paterva.com domain is redirected to maltego.com.
• 2022-08Bellingcat publishes a survey of open-source researchers in which Maltego is rated the third most-favored and second most-helpful investigative tool.
• 2020sMaltego expands its product line beyond the original desktop client to include Maltego Graph, Search, Monitor, Evidence, and Data offerings for OSINT and threat-intelligence teams.