Desktop
Step-by-step workflow guide for investigators
Company Vetting
Starting from a company name with almost no contact information, this guide walks you through locating the business in a corporate registry, identifying the people formally behind it, surfacing real ways to reach them, and screening against sanctions lists. By the end, you will have contact routes that were never published on the site — or a documented set of registry findings that explains why the company does not hold up to scrutiny.
Who is this for?
Corporate investigators, due diligence analysts, and brand protection teams looking into a business that exists mainly as a website. The trigger to use this workflow is a company you cannot contact or verify through its own published channels, where you need to establish who is actually behind the business and how to reach them. It is equally applicable to brand infringement cases, supplier vetting, and counterparty checks before a transaction.
What is on this page?
A video walkthrough of a company vetting case, followed by step-by-step guide in Maltego Graph (Desktop).
The workflow covers finding the company in a corporate registry provider by jurisdiction, extracting officers and the registered address, testing whether the officer runs other companies, and converting a name into phone numbers and email addresses through people-search data.
The workflow covers finding the company in a corporate registry provider by jurisdiction, extracting officers and the registered address, testing whether the officer runs other companies, and converting a name into phone numbers and email addresses through people-search data.
How to use this page?
Watch the video at the top for an end-to-end overview, then follow the written steps below to conduct an investigation using your own domain.
New to Graph?
No problem. Every platform feature mentioned in this guide links to the relevant product documentation so you can read up as you go.
A note on results
The steps here reflect what works for most customers in this use case. Because Graph (Browser) works with live data, results depend on what is actually available at the time you run Transforms. Maltego cannot guarantee the same outcome for every case.
Data providers used on this page
This workflow draws on two categories of data: corporate registry records, which tell you whether a company legally exists and who is formally attached to it, and people-search records, which turn a name into contactable identifiers.
The following data providers are included in the Person of Interest and Corporate Intelligence Data Pass modules:
— OpenCorporates — company registration records for US companies. Returns the registered entity, its jurisdiction and status, officers, and the registered address if available for the particular company.
— North Data — company registration records for European companies.
— Pipl — a broad people-search engine with access to public and government records. Given a person's name and other optional identifiers, it returns phone numbers, email addresses, and associated locations.
The following data providers are included in the Person of Interest and Corporate Intelligence Data Pass modules:
— OpenCorporates — company registration records for US companies. Returns the registered entity, its jurisdiction and status, officers, and the registered address if available for the particular company.
— North Data — company registration records for European companies.
— Pipl — a broad people-search engine with access to public and government records. Given a person's name and other optional identifiers, it returns phone numbers, email addresses, and associated locations.
Before you start:
Identify the starting point
Company name you are trying to investigate.
Note: The legal suffix is your jurisdiction signal and decides which registry provider you run: LLC or Inc points to the US, Ltd or PLC to the UK, GmbH or BV to Europe.
Access
- Download and install Graph (Desktop).
- Install the Corporate Intelligence and Person of Interest Data Pass modules from the Data Hub within Graph (Desktop).
Note: Basic users have limited access to the data providers used in this workflow more generally — some transforms may be unavailable or return restricted results depending on your plan tier.
Resources
This guide assumes basic familiarity with Graph (Desktop). Feature names link to the documentation where needed. It helps to have the following pages open before you start:
Video Overview
Watch a company vetting workflow demonstration. Then follow the step-by-step guide below to build your own, or skip the video and jump straight to the steps.
To enlarge, double-click on the video.
Step-by-Step Guide
Step 1: Run a corporate registry search on a company name
Begin with adding a Company Entity to the graph and renaming it including the suffix of the jurisdiction. For example, Maltego Technologies GmbH.
The legal suffix is your jurisdiction signal and decides which registry provider you run:
The jurisdiction will affect your choice of the data provider:
How to:
The legal suffix is your jurisdiction signal and decides which registry provider you run:
- LLC or Inc points to the US.
- Ltd or PLC to the UK.
- GmbH or BV to Europe.
The jurisdiction will affect your choice of the data provider:
- Open Corporates — the choice for US registrations.
- North Data — strongest coverage for European companies.
- Companies House — the UK registry.
How to:
- Right-click on the Company Entity to open the Transform Menu.
- Run the Search Companies Transform within the Corporate Intelligence Data Pass. Choose the data provider best suited for the jurisdiction of the company.
Keep the first run broad and exploratory
The corporate search Transforms let you supply extra details to narrow the search, but every detail you add is a filter that can exclude the correct record. This matters most when the site's own information is thin or deliberately misleading. Start open, then narrow only if you get too many results back.
The corporate search Transforms let you supply extra details to narrow the search, but every detail you add is a filter that can exclude the correct record. This matters most when the site's own information is thin or deliberately misleading. Start open, then narrow only if you get too many results back.
Step 2: Expand the company record for officers, address, and financial reports
Run Fetch full information OR Expand in full Transforms depending on the data provider.
Open Corporates will return financial reports, officers, and address Entities to the graph.
If using North Data, either double-click on the Entity and explore the Entity Properties or run separate Transforms such as To Officers and To Address to put this information on the graph.
Open Corporates will return financial reports, officers, and address Entities to the graph.
If using North Data, either double-click on the Entity and explore the Entity Properties or run separate Transforms such as To Officers and To Address to put this information on the graph.
Check the registered address on a map
What you are testing is whether the address supports the kind of business the website claims to be.
How to:
Copy the address form the Entity Properties.
Open it in a mapping tool and look at both the street view and the surrounding area
What you are testing is whether the address supports the kind of business the website claims to be.
How to:
Copy the address form the Entity Properties.
Open it in a mapping tool and look at both the street view and the surrounding area
Characterise it: residential street, commercial or industrial unit, office block, or a registered-agent address used by many companies
Compare it against what the site claims — a business advertising a retail store should not be registered to a house in a residential neighbourhood.
Step 3: Check whether the officer runs other companies
How to:
Reading the result:
- Select the officer Entity on your graph
- Right-click and run To Companies Transform.
Reading the result:
- A long list of companies — registering many shell Entities under one name, or fabricating an officer identity that exists only on paper, is common. Treat each returned company as a lead.
- A small number of plausibly related companies — more consistent with a genuine small-business owner. Note them and continue.
- No other companies — not a dead end, and not an exoneration either. It simply means this route adds nothing; move to the next step and pursue the person directly.
Step 4: Run a people search on the officer's name and address
The company record has now given you everything it is going to. This step moves from the corporate registry to the individual, using a people-search provider with access to public and government records to attach real identifiers to the officer's name.
How to:
- Select the Officer Entity and navigate to [POI] Search Person [Pipl].
- Add the registered address as a parameter, pasting it in raw exactly as the registry returned it
- Run the Transform — with name and address together you should get a single result
- Select the returned Person Entity and run Expand in Full Transform to pull out information on the person.
What you can find:
Each of these is also a pivot point for further investigation if your scope extends that far.
- phone numbers
- email addresses often unconnected to the business domain,
- associated addresses that corroborate or contradict the registered one.
Each of these is also a pivot point for further investigation if your scope extends that far.
Optional: Screen the company or officers against sanctions lists
Run this step when the company turns out to be legitimately registered and you are considering doing business with it.
How to:
- Run Search Company [OpenSanctions] on the Company Entity.
- Repeat for each officer identified in Step 2.
- Repeat for each related company surfaced by Open Corporates or North Data.
What Open Sanctions covers:
- OFAC - US Treasuary designations, including country-specific sanctions programmes.
- SECO — Swiss sanctions
- UN Security Council, EU and UK sanctions regimes
- Sanctioned cryptocurrency addresses
If the company appears in the Open Sanctions records, on their website you can find:
— The sanctioning programme — which authority listed the entity and under which regime, for example a country-specific OFAC programme.
— The scope of the designation — read this carefully. A designation extending to all offices worldwide reaches branches and subsidiaries that are not separately named
— The registered address and identifying detail for the listed entity
— Recorded assets and holdings — including percentage stakes in other entities, each of which is a further lead
— The source of the record — including, in some cases, leaked corporate registries. Note the provenance, as it affects how the finding can be used
Note that Open Sanctions matches approximately on the parameters you pass, so it returns names that could correspond to your subject. Read each result and establish whether any is an exact match, not merely a similar name.
If you find an exact Entity match, find the link to the Open Sanctions website in the Detail View window on the right of the Graph window and open the page to explore more information on the sanctioned entity.
What's next?
-
Map the person's entire digital footprint by locating their social media.
-
Find a real-world identity behind an alias.
-
Assess the risk for your organization by monitoring company information and employee login credentials being sold on the darkweb.
Other guides you might find useful:
Give us your Feedback!
Copyright © 2026
What is Maltego?
Write your awesome label here.