Maltego is a visual link-analysis tool that turns scattered OSINT selectors into a single connected graph, and its free Community Edition makes it the default canvas for investigators who need to see how a username, email, domain or wallet relates to everything around it. You start with one piece of data, run transforms that fetch related data, and watch the graph grow into a picture of an actor’s infrastructure and aliases. This tutorial covers the core concepts, entities, transforms and machines, and how to build a defensible link chart from a single starting point.
What is Maltego?
Maltego is a desktop application for graph-based OSINT and link analysis. Where a spreadsheet lists facts, Maltego draws them as nodes and edges, so relationships that would be invisible in a table become obvious on a canvas. Analysts use it to map a target’s digital footprint, connecting people, domains, IP addresses, social accounts, cryptocurrency addresses and more into one investigable structure. It is the tool most practitioners reach for when a case has grown past what they can hold in their head, and it is the natural home for the selector work in our threat-actor handle pivoting guide, where the whole point is stacking independent identifiers into a corroborated cluster.
What are entities and transforms?
Two concepts do most of the work. An entity is a defined piece of data on the graph: an email address, a domain, a person, a phone number, a Bitcoin address. A transform is a small piece of code that takes an entity as input, goes and looks something up, and returns related entities as output. Drop a domain entity on the canvas, run a transform, and Maltego might return the DNS records, subdomains, email addresses and IPs tied to it, each as a new entity linked back to the original. Chain transforms together and the graph expands outward from your single starting selector, each hop revealing the next layer of the target’s footprint. That input-to-related-output loop is the entire mechanic of the tool.
What are Maltego machines?
Running transforms one by one is fine for a small graph, but it gets tedious fast. Machines are the automation layer: a machine is a macro that runs a whole sequence of transforms over a data set in one action. Maltego ships with pre-built machines for common tasks like footprinting a domain or an organisation, and they are free for all users. Point a machine at a starting entity and it fans out several hops automatically, assembling a large graph while you watch rather than clicking through each transform. For repeatable investigation patterns, machines turn a manual afternoon into a single run, and they are the feature that separates a casual Maltego user from someone who works cases at volume.
What can you do with the free Community Edition?
Maltego Community Edition is the free tier, and it is genuinely useful rather than a crippled demo. CE runs on the Basic plan and gives you a monthly allowance of credits to spend on transforms against built-in data, which is enough to learn the tool and run real, if modest, investigations. The limits are real: CE caps how many results a transform returns, holds back some premium and breach-data sources, and meters your monthly credits, so heavy or commercial work eventually pushes you to a paid plan. But for learning link analysis, mapping a small target, and following the kind of selector chains that matter in ransomware OSINT, the free edition covers the ground. Do not pay until the case actually demands the higher limits.
How do you run your first graph?
The first run is quick. Install Maltego and register for a free CE account, then open a new graph. Drag an entity from the palette onto the canvas, a Domain is the classic starting point, and double-click it to set the value to your target. Now run a transform: right-click the entity and pick from the menu, or select it and choose from the Transforms panel on the left. New entities appear, linked to the original. Repeat on the interesting ones, or drop a machine onto the entity to automate several hops at once. For a ransomware investigation, the same flow works with a Bitcoin address or a persona: seed the graph with one confirmed selector, transform outward, and corroborate. When a wallet appears on the canvas, follow it with the methods in our on-chain tracing walkthrough and bring the result back as an attribution.
Frequently asked questions
Is Maltego free?
Maltego offers a free Community Edition on its Basic plan, which includes a monthly credit allowance and the standard transforms and machines. Paid plans lift the result caps and unlock premium and breach-data sources for heavier or commercial work.
What is the difference between an entity and a transform?
An entity is a piece of data on the graph, such as a domain or email address. A transform is code that takes an entity as input, looks up related information, and returns new entities linked to it.
What are Maltego machines?
Machines are macros that run a sequence of transforms over a data set automatically. Maltego ships free pre-built machines for tasks like domain footprinting, letting you build a large graph in one action instead of running transforms one by one.
Can Maltego trace cryptocurrency?
Maltego can hold cryptocurrency addresses as entities and run transforms against them, and it integrates with blockchain data sources to link wallets into a wider graph. For deep flow tracing you pair it with a dedicated tool and bring the result back as an attribution.
Is Maltego good for beginners?
Yes. The free Community Edition, the visual canvas and the pre-built machines make it approachable, and dragging one entity then running a transform teaches the core loop in minutes. The limits only start to bite on large or commercial investigations.