Browser
Step-by-step workflow guide for investigators
Real-world Identification
Starting from a social media alias, this Graph (Browser) guide walks you through discovering linked accounts across platforms, surfacing alternate usernames, and corroborating a real-world identity. By the end, you will have attributed an online persona to a real individual from gathered cross-platform evidence.
Who is this for?
Intelligence analysts and investigators who need to identify the real person behind an online alias. The trigger to use this workflow is having a username and needing to determine who that person actually is — their real name and any supporting identity indicators. This workflow is typically used as a follow-on to Digital Footprint Mapping, or when a subject's identity is the primary investigative question.
What is on this page?
A video walkthrough of a real case, followed by step-by-step guide for using Maltego Graph (Browser) to link social media profiles to a real-world identity. The workflow covers running comprehensive searches, supplementing with platform-specific Transforms, discovering alternate aliases from profile bios, and corroborating identity using visual and contextual indicators across platforms.
How to use this page?
Watch the video at the top for an end-to-end overview, then follow the written steps below to conduct an investigation using the person of interest of your choice.
Follow the steps in order. This is an iterative workflow — each step may reveal new leads that feed back into earlier steps. The more accounts your subject has, the more corroboration you'll be able to build.
Please note that the data returned by Graph is always live, and the results in the video demonstration might not be reproduced at a later time if they disappeared from the public domain.
Follow the steps in order. This is an iterative workflow — each step may reveal new leads that feed back into earlier steps. The more accounts your subject has, the more corroboration you'll be able to build.
Please note that the data returned by Graph is always live, and the results in the video demonstration might not be reproduced at a later time if they disappeared from the public domain.
New to Graph?
No problem. Every platform feature mentioned in this guide links to the relevant product documentation so you can read up as you go.
A note on results
The steps here reflect what works for most customers in this use case. Because Graph (Browser) works with live data, results depend on what is actually available at the time you run Transforms. Maltego cannot guarantee the same outcome for every case.
Before you start:
Identify the starting point
- Alias of the account you are assessing.
- Optional: Any known context about the subject — platform they're active on, interests, approximate location.
Note: The more distinctive the username, the cleaner your results will be.
Access
- Open Maltego Graph (Browser) from app.maltego.com .
Note that you need a Maltego ID to log in. - Make sure your plan includes access to the product (not included for Basic plan users).
- Check if your Organization Admin enabled access to the AI Assistant.
Credit Management
- Check your organization Credits before starting.
- This workflow is iterative — if multiple alternate aliases are discovered, each requires its own search run.
- Monitor Credit usage after each Transform to stay within limits.
Resources
This guide assumes basic familiarity with Graph (Browser). Feature names link to the documentation where needed. It helps to have the following pages open before you start:
Related workflows:
- Digital Footprint Mapping — if you want to map the subject's online presence.
- Search: Person of Interest / Identity Resolution — for email address investigations.
⚡
Any real-world identity information found through this workflow must be verified against legal or official records before being used in formal proceedings or decisions.
Video Overview
Watch a real-world identification workflow demonstration. Then follow the step-by-step guide below to build your own, or skip the video and jump straight to the steps.
To enlarge, double-click on the video.
Step-by-Step Guide
Step 1: Add Your Starting Alias and Run a Comprehensive Search
Begin by placing the target username on your graph and running a comprehensive search to discover all social media profiles associated with that alias.
How to do it:
What you will find:
Your graph will populate with social media profile Entities across platforms. Typical results may include profiles on major social platforms, forums, and content sites. Each Entity will show the platform, the username, and — where publicly available — a display name or bio snippet.
How to do it:
- Click "Add Entities".
- Find and select the Alias Entity type — usernames are called aliases in Graph.
- Click on the Entity and change the default text to your target username (e.g., username_example).
- Right-click the Alias Entity to open the Transform menu.
- Navigate to: Comprehensive Search -> Search Online Profiles.
- Set the output size to Large to maximise the number of results returned.
- Click Run.
What you will find:
Your graph will populate with social media profile Entities across platforms. Typical results may include profiles on major social platforms, forums, and content sites. Each Entity will show the platform, the username, and — where publicly available — a display name or bio snippet.
Step 2: Evaluate Returned Profiles and Cross-Check for Consistency
Not every returned profile will be useful for real-world identification. Review what you have and identify which accounts show strong indicators of belonging to the same person.
What to look for:
What to look for:
- Bio overlap: Shared interests, phrases, or keywords appearing across multiple profiles — these are strong corroboration signals.
- Language and location indicators: Consistent language use (e.g., same non-English language across bios) or regional flags and references.
- Profile pictures: If a profile displays a photo of the account owner, note it — you'll use it for visual cross-referencing later.
Step 3: Visit Key Profiles Directly on the Platform
For platforms where users frequently link additional accounts in their bio such as video and streaming platforms (e.g. TikTok, YouTube), open the profile directly on the platform.
What to look for:
What to look for:
- Links to other platforms in the bio.
- Photos and videos where the subject may appear in person.
- New aliases from links to other platforms.
Repeat Step 1 if you discover a new alias in the bio.
Step 4: Run Supplementary Platform-Specific Transforms
Data providers occasionally fail to return results, and comprehensive search doesn't guarantee full coverage. Running supplementary transforms for platforms you'd reasonably expect to find your subject on is good investigative practice.
If your subject is active on platforms you'd expect to see but haven't found yet, run targeted transforms for those platforms separately. In Graph (Browser), platform-specific Transforms start with "Deep Dive - [Platform Name]".
If your subject is active on platforms you'd expect to see but haven't found yet, run targeted transforms for those platforms separately. In Graph (Browser), platform-specific Transforms start with "Deep Dive - [Platform Name]".
Generic vs. Exact search:
Some platform-specific transforms search by profile name rather than exact username match:
Some platform-specific transforms search by profile name rather than exact username match:
- Search Profiles Transform returns profiles with similar names. This can return profiles with similar names that don't belong to your subject.
- Get Profile Transform returns the exact username match if one exists.
Confirming a match:
When a new platform profile is returned, verify it belongs to your subject using the same corroboration signals from Step 2: shared bio content, profile picture consistency, language, and stated interests. A matching profile picture across platforms is a particularly strong indicator.
When a new platform profile is returned, verify it belongs to your subject using the same corroboration signals from Step 2: shared bio content, profile picture consistency, language, and stated interests. A matching profile picture across platforms is a particularly strong indicator.
Step 5: Identify a Real Name and Corroborate Visually
By this stage you may have one or more candidate real names appearing in profile results. Use visual evidence — profile photos across platforms — to assess whether the name is consistent with a real individual.
Evaluating a Candidate's name:
Visual Corroboration:
Evaluating a Candidate's name:
- Check whether the name appears on more than one platform. A name that shows up consistently across multiple accounts is a stronger signal than a single occurrence.
- Look at whether the name is plausible in the context of other indicators (e.g., consistent with the language, region, or cultural references you've observed).
- Note the name but treat it as unverified until you have supporting evidence.
Visual Corroboration:
- Compare profile photos across platforms where the subject has uploaded images of themselves.
- Look for consistent physical identifiers: distinctive items of clothing or jewellery, tattoos, or repeated use of the same photograph
- If a profile photo on one platform matches an image on another, that is a meaningful corroboration signal.
What's next?
-
Set up Threat Actor Monitor to keep tabs on the threat actor if you suspect they might present danger.
-
Run a Personal Threat Assessment if the identified individual may pose a risk to a person or organization.
-
Map the threat actor's entire digital presence.
Other guides you might find useful:
Give us your Feedback!
Copyright © 2026
What is Maltego?
Write your awesome label here.