Maltego Graph
Link analysis across internal and external data; the vendor cites 100+ ready-made connectors and API support for your own sources (Graph).
Maltego OSINT Review: Link Analysis, Pricing and Alternatives
Maltego OSINT work centers on one idea: put people, companies, domains and accounts on a graph and let the links show you what a list cannot. This review covers what the Maltego OSINT tool does, what the free edition allows, what paid plans cost and when another tool fits better.
- Graph-based link analysis
- Free Community Edition
- Paid plans from €3,000 a year
- No affiliation with the vendor
Short answer
Maltego is a link analysis platform from Maltego Technologies in Munich. Analysts run transforms that pull data about an entity, such as a domain, email or company, and Maltego draws the results as a graph. It suits trained investigators and cyber teams. A free Community Edition exists with tight limits; paid plans start at €3,000 a year.
What Is the Maltego OSINT Tool?
A desktop and web investigation platform for link analysis, with built-in access to commercial and open data through connectors.
Maltego Technologies, headquartered in Munich, Germany (Maltego), describes its product as an all-in-one investigation platform for cyber and OSINT work. The vendor says it gives access to 120+ data providers and is ISO 27001:2022 certified (official site).
The core product, Maltego Graph, runs as a desktop client for Windows, macOS and Linux; version 4.8.1 is current and needs a 64-bit Java 8, 11 or 17 runtime (downloads). Around it the vendor sells Search, Monitor, Evidence, Cases and, since May 2025, Hunchly. In our catalog of OSINT tools it sits under link analysis and case management.
How Maltego Link Analysis Works
You place an entity on a graph, run transforms that query data sources, and review the new entities and links they return.
- Start with an entityA domain, email address, phone number, person, company, IP address or social account is placed on the graph.
- Run transformsEach transform queries a source, such as DNS, a company register or a commercial data connector, and returns related entities.
- Expand and pruneThe analyst follows promising branches and deletes noise; the graph is a working hypothesis, not a finding.
- Verify outside the graphKey links are checked against the original source and documented before they reach a report.
Key Features of the Maltego Platform
Graph for link analysis, Search for quick lookups, Monitor and Evidence for social media, plus data connectors and case management.
Maltego Search
Quick searches on suspects and threat actors across social media, dark web, identity and breach data.
Monitor and Evidence
Social media monitoring with AI-assisted analysis, and capture and preservation of social media data.
Hunchly
Web capture for investigators, acquired by Maltego in May 2025 and bundled from the Entry plan (announcement).
Data connectors
Credits-based access to commercial data; the Graph page cites 200+ social platforms, 200 million company records and 1 TB+ of breach data.
Cases and Admin
Shared case storage and cross-correlation, plus audit and access management for teams.
Maltego Community Edition: What the Free Version Includes
Maltego Graph CE is free with a Maltego ID, but returns at most 24 results per transform and offers only limited data access.
The vendor's documentation lists the Community Edition limits (Maltego docs):
- Up to 10,000 entities on a single graph.
- Up to 24 results per transform.
- 200 monthly credits and limited access to out-of-the-box Data Pass modules and connectors.
- A free Maltego ID is required.
CE is useful for learning the method and for small infrastructure graphs. For casework, the 24-result cap means large result sets are cut off without telling you what was left out, which is a problem when completeness matters.
Maltego Pricing and Plans
Four tiers priced per year in euros: free Basic, Entry at €3,000, Professional at €7,500 and quoted Enterprise.
| Plan | Price | Monthly credits | What it adds |
|---|---|---|---|
| Basic / Basic+ | €0 | 200 / 1,000 | Graph Community Edition; Basic+ adds Maltego Search for users who register with an official government or organizational email |
| Entry | €3,000 a year | 10,000 | Everything in Basic+, plus Hunchly; for vetted users, others are offered Entry Lite |
| Professional | €7,500 a year | 20,000 / 40,000 | Full Graph, unlimited Search and out-of-the-box commercial data; up to 5 users, billed per seat |
| Enterprise | Quoted by sales | Flexible | Optional Monitor and Evidence, training, premium support, for teams of 5+ and government |
Source: Maltego pricing page, checked 10 October 2026. The page does not say whether the Professional price is per seat or for the plan, nor the Entry Lite price; confirm both in writing.
What Maltego Is Used For in OSINT Investigations
Mapping infrastructure, threat actors, corporate networks and fraud rings, where the value is in seeing how many entities connect.
- Cyber threat intelligence. Pivoting from one malicious domain to shared hosting, registrants, certificates and related infrastructure.
- Corporate and fraud cases. Linking companies, directors, addresses and phone numbers to spot shared control or shell structures.
- Person-of-interest work. Connecting a phone number or email to accounts and aliases, within the limits of a lawful purpose.
- Training. Teaching analysts to record their reasoning visually, which is why it appears in many OSINT courses.
If your case is about one email or one username, a dedicated lookup tool is faster. Maltego earns its cost when the question is how dozens of entities connect.
Who It Suits and Who It Does Not
It suits trained analysts and teams with recurring, multi-entity cases; it is heavy for occasional users and one-off questions.
| Good fit | Poor fit |
|---|---|
| SOC and threat intelligence teams mapping infrastructure | One-off checks on a single identifier |
| Government, law enforcement and financial crime units | Small teams without time to learn transforms and graph hygiene |
| Investigators who need a visual record of reasoning | Buyers who need a finished, verified report rather than a graph |
Limitations and Risks
Graphs look authoritative even when links are weak, costs rise with data use, and the analyst stays responsible for lawful collection.
- False links. A transform that returns a shared IP, a common name or a reused phone number draws a line that looks as solid as a confirmed one. Every key link needs checking at the source.
- Learning curve. Transforms, credits and connectors take time to master; untrained use produces large, noisy graphs.
- Cost creep. Commercial data is metered in credits, and some connectors carry their own subscriptions.
- Lawful use. Personal data in a graph is still personal data under the GDPR; collect for a defined purpose and keep only what you need.
Maltego Alternatives for OSINT Link Analysis
Social Links, ShadowDragon and Lampyre offer commercial investigation platforms; SpiderFoot and Recon-ng are free, open-source automation.
Social Links
SL Crimewall platform and SL Professional for Maltego, citing 850+ open sources (Social Links).
Social Links review →ShadowDragon
Horizon platform with identity triage, link analysis and monitoring, plus the SocialNet API (ShadowDragon).
ShadowDragon review →Lampyre
Data analysis tool with graphs of up to 10,000 objects on PLUS plans from $116 a month or $807 a year (pricing).
Lampyre review →SpiderFoot
MIT-licensed OSINT automation with 200+ modules and GEXF export for graph tools.
SpiderFoot review →Recon-ng
GPL-3.0 reconnaissance framework for web-based information gathering, run from the command line.
Recon-ng review →OSINT Industries
Selector lookups for email, phone and username from £19 a month, when you need accounts, not a graph.
OSINT Industries review →Need the Answer, Not the Tool?
If you need a verified map of who connects to whom, an analyst-led investigation can deliver it without a license or training budget.
A Maltego graph is a working file; a decision needs links that were checked at the source and explained in plain language. Our company investigations map ownership and control, and our cyber investigations trace infrastructure behind attacks. Each report gets a senior analyst review, with a fixed quote after written scoping and focused checks from 10 business days.
If your team wants to run the tools itself, OSINT training covers method and lawful collection. For anything else, see our OSINT services overview.
Get the Map Without the License
Send us the entities you start from, the question and your deadline. We scope it in writing and quote a fixed fee.
Maltego OSINT FAQ
I keep seeing the Maltego OSINT tool in investigation courses — what is it actually used for, and do I need it if I mostly check single emails and phone numbers?
Maltego is used for link analysis: putting people, companies, domains and accounts on a graph and expanding them with transforms to see how they connect. It shines in threat intelligence, fraud rings and corporate structures. If you mostly check one email or phone number at a time, a dedicated lookup tool is faster and cheaper; Maltego earns its cost when cases involve dozens of connected entities.
I'm a student on a tight budget — is the Maltego Community Edition free for OSINT practice, and what limits will I hit compared with the paid version?
Yes, Maltego Graph Community Edition is free once you create a Maltego ID. The documented limits are 24 results per transform, 10,000 entities per graph, 200 monthly credits and limited access to Data Pass modules and connectors (Maltego docs). That is enough to learn the method. Registering with an official organizational email may qualify you for Basic+ with 1,000 credits and Maltego Search.
Our five-person fraud team has been quoted for Maltego Professional — how much does Maltego cost per year, and what should we clarify before we sign?
The pricing page lists Entry at €3,000 a year and Professional at €7,500 a year, with up to 5 users billed per seat; Enterprise is quoted (pricing). Ask in writing whether €7,500 is per seat or for the plan, how many credits your typical cases consume, which third-party connectors need separate subscriptions, and whether you pass vetting for Entry or get Entry Lite.
We want to find the official Maltego site and download — which domain is the real one, and what does our IT team need to install the desktop client?
The official site is maltego.com, with documentation at docs.maltego.com and the web app at app.maltego.com. The Graph desktop client runs on Windows, macOS and Linux; version 4.8.1 is current and needs a 64-bit Java 8, 11 or 17 runtime (downloads). Avoid installers from third-party download sites, and have IT approve the Java runtime before rollout.
Can I use Maltego for phone number OSINT on someone who keeps calling my staff, or is that crossing a legal line for a small company like ours?
You can investigate a number that is harassing your staff if the purpose is defined and proportionate, such as identifying the caller to report them or support a complaint. Keep collection to what answers that question, record your steps, and do not use the results to confront or track the person. Under the GDPR, personal data in a graph is still personal data. If the calls are threatening, involve the police first.
Our managers like the Maltego graphs our analyst produces — can we put those graphs straight into a board paper or court filing as evidence?
Not on their own. A graph shows what transforms returned, and weak links look as solid as strong ones. Before a graph goes to a board or court, each important link should be verified at the original source, captured with date and URL, and explained in a written report. Tools such as Hunchly help with capture; an analyst still has to confirm that each connection means what the graph suggests.
Sources and Notes
- Maltego: pricing
- Maltego: official site
- Maltego: Graph
- Maltego docs: What is Maltego Graph Community Edition
- Maltego: downloads
- Maltego: Maltego welcomes Hunchly (19 May 2025)
- Social Links: homepage
- ShadowDragon: homepage
- Lampyre: pricing
- SpiderFoot on GitHub
- EU General Data Protection Regulation
Sources checked 10 October 2026. This review is based on the vendor's public pages and documentation, not on a paid license. OSINT-S has no affiliation with Maltego Technologies and does not resell tools.