Step-by-step workflow guide for investigators
Digital Footprint Mapping
Who is this for?
The trigger to use this workflow is having an alias of the person of interest and needing to discover what other platforms, accounts, and identifiers are connected to that person.
What is on this page?
How to use this page?
The workflow is designed to be completed in under 15 minutes. Have the username of the account you're assessing ready before you begin.
Please note that the data returned by Graph is always live, and the results in the video demonstration might not be reproducible at a later time if they disappeared from the public domain.
New to Graph?
A note on results
Before you start:
Identify the starting point
Alias of the account you are assessing.
You can also use this workflow starting with an email address. Repeat the same steps as for the alias.
Note: The more unique the username, the higher quality your results will be. Normal text.
Access
- Open Maltego Graph (Browser) from app.maltego.com.
Note that you need a Maltego ID to log in. - Make sure your plan includes access to the product (not included for Basic plan users).
Resources
This guide assumes basic familiarity with Graph (Browser). Feature names link to the documentation where needed. It helps to have the following pages open before you start:
If you have not identified a specific account to assess for threats, consider setting up a VIP protection , event monitoring, or brand reputation monitors first to see the actors posting violent or threatening content in relation to a person or an event.
Video Overview
Watch a digital footprint mapping workflow demonstration. Then follow the step-by-step guide below to build your own, or skip the video and jump straight to the steps.
To enlarge, double-click on the video.
Step-by-Step Guide
Step 1: Run a comprehensive social media search
- Add the Alias Entity to the graph.
- Open the Transform menu by right-clicking on the Entity.
- Run Comprehensive Search → Search for Online Profiles.
This search queries multiple platforms simultaneously (Facebook, Instagram, Snapchat, Twitter, GitHub, Etsy, Trello, and many more), giving you the broadest initial coverage without running separate transforms for each platform.
What you can find
Once the Transform runs, the graph will populate with social media profile Entities. Each profile shows:
- Platform icon
- Username: The alias on that platform.
- Given name: If the user provided one on their profile (treat with caution, as it can be easily faked). Look for consistency across multiple platforms before treating a name as credible.
- Alternate usernames: Some profiles may show additional handles the user goes by.
Step 2: Look for breach data
How to:
- Open the Transform menu by right-clicking on the Entity.
- Run Comprehensive Search → Search in Breaches.
What you can find
- Deleted accounts: Platforms where the username existed but has since been removed.
- Email addresses: Associated emails that aren't publicly displayed on profiles.
- Additional platforms: Accounts on platforms you didn't find in the first search (e.g., Telegram, GitHub).
- Consistency check: Cross-reference names and identifiers to confirm you're tracking one person, not multiple users with the same handle.
Step 3: Expand your search using discovered email addresses
Email addresses discovered in Steps 1 and 2 can unlock additional profiles that don't use the same username. Repeat steps 1 and 2 on these emails to ensure you haven't missed accounts where the person uses a different alias.
Why search emails?
Many people use different usernames across platforms but register all accounts with the same email address. Searching emails ensures you capture accounts where the person doesn't use their primary alias, giving you a more complete footprint.
Which emails to search?
Avoid email addresses that appear to be disposable or temporary. Examples could include Temp Mail, 10MinuteMail, Guerilla Mail, Proton.
If an email address shares the same username pattern as the original alias, treat that as a strong signal that the associated social media account belongs to the same person.
When to stop?
Stop when:
- You've exhausted the direct identifiers (username + discovered emails).
- New results are not yielding additional unique platforms or identities.
- You've consumed your budgeted credits for this investigation.
- You have sufficient coverage for your investigation goal.
What's next?
-
If your goal is to map the online presence of an alias identity, you're done after this workflow.
-
Set up a Threat Actor monitor for tracking the person's social media feed for threatening posts.
-
Check out the guide for Maltego Evidence for collecting and preserving social media posts from the person's of interest account before it disappears,
Other guides you might find useful:
Give us your Feedback!
Copyright © 2026
