Step-by-step workflow guide for investigators

Person of Interest Investigations and Identity Resolution

This page is for analysts who need to identify, verify, or map the online presence of an individual using Maltego Search. Maltego Search is best used at the beginning of a person-focused investigation. It surfaces connections across more than 16 data sources quickly, and works best when you have at least one concrete identifier to start from.

This guide presents you a workflow with three focus areas: real-world identification, identity verification, and digital footprint search. While the steps in the tools are always the same, the interpretation of results varies by the purpose of the investigation. This guide shows you how to read those results, cross-reference them, and reach a confident conclusion about who is behind the identifier and their digital footprint.

Before you start:

What you need

  • An identifier supported by Maltego Search: alias, email address, or a phone number.
  • Check that you have enough Credits left to run searches at the top of the home screen within the Maltego app.

Platform limits

  • Credits are consumed per search — running a search multiple times uses additional Credits.  
  • Partially masked results (e.g. j***7@g****.com) are returned if stored this way by the data provider. Use domain patterns and length to interpret them.

Access

  • Open Maltego Search from the Maltego app. Note that you need a Maltego ID to log in.

Video Overview

Watch a real email address being looked up in Maltego Search: from first result to confirmed identity.

The walkthrough covers how to find the real-world person behind an identifier, verify that it is really them, and surface their social media presence.

Follow the step-by-step guide below to run your own investigation after watching the video, or skip the video and jump straight to the steps.

To enlarge, double-click on the video.

Step-by-Step Guide

1. Enter your starting identifier

Email address

Strong starting point. 

Phone number

Strong secondary identifier. 

Alias

Useful when the subject uses a consistent online handle. 
⚡

Maltego Search also supports passwords, names, and domains as starting points.
Starting with a password is not generally recommended. If the password appears to be unique — personally chosen rather than generated by a password manager, and unlikely to be shared across unrelated accounts, it can be a useful pivot point.
For domain and name investigations, Maltego Graph (Desktop) is recommended instead.

2. Read and interpret the results categories

After running your search, analyze the results in the table. The three workflows below share the same result types. What changes is the priority order of looking at result types and what a complete result looks like for each goal. Use the workflow cards to orient your approach, then refer to the full result type guide below.

Real-world identification

You don't know who this person is.
The goal is to establish a real-world identity from an online identifier by looking at the result types more closely in the following suggested order. 


Priority order:

      1. Person
      2. Compromised record
      3. Profile images
      4. Social media profiles
      5. Locations
      6. Phone numbers
      7. Aliases

      This workflow is complete when the name is corroborated by 2+ independent high-credibility sources. Social media alone is not sufficient.

      Identity verification

      You have a claimed identity.
      The goal is to confirm the person behind the identifier is who they say they are.



      Priority order:

      1. Compromised records
      2. Person
      3. Profile images
      4. Phone numbers
      5. Social media profiles
      6. Locations


      The workflow is complete when identity is confirmed by multiple signals with at least one from a high-credibility source where false registration is unlikely.

      Digital footprint 
      search

      You know who the subject is.
      The goal is to map everything they have left online — accounts, handles, images, locations.



      Priority order:

      1. Social media profiles
      2. Aliases
      3. Profile images
      4. Phone numbers
      5. Compromised records
      6. Locations


      The workflow is complete when all surfaced identifiers return no new connections. Document open threads and move to Graph (Desktop).

      NOTE: NOTE:

      The table below explains each result type: what it is, why it matters, and how to evaluate it.

      href="https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&family=DM+Mono:wght@400;500&display=swap" rel="stylesheet">
      Result type
      What to look for and why
      Person / name
      • Check the occurrence count  — a number next to the Entity. This is the number of independent data sources that link your starting identifier to a given name. The higher the count, the stronger the signal: a name appearing across 13 separate, unrelated sources is far more reliable than one appearing in a single source, because it means 13 independent datasets are all pointing to the same conclusion.
      • Open the details panel by clicking on the result to see the full suggested name and the specific sources behind each occurrence.
      • Cross-reference the alias pattern with the suggested name. For example, jeryan87 maps to J. Ryan, with 87 suggesting a birth year. A match between the alias structure and the surfaced name is a meaningful corroborating signal.
      Compromised records
      • Remember that not all breach sources are equal. Always check which website or service the breach originates from before drawing conclusions.
      • Airline, travel booking, leaked government or bank records (if available) are strong signals.Services like these require real identity, making it very difficult to use a false name.
      • Social media platform breaches carry significantly less weight — anyone can create an account with a fake name, so a name appearing in a Twitter or forum breach alone is not sufficient to confirm identity.
      • Compromised records also reveal platforms and services the subject has registered with, including accounts they may no longer use actively, but could be useful for building a broader picture of their online presence.
      Profile images
      • Different pictures showing the same person in different situations/styles/ages is a strong indicator you are looking at a single real individual, not a fabricated identity.
      • Look for the same image appearing across multiple unrelated platforms. This matters because maintaining a consistent profile image across many different services requires deliberate effort — it is not something that happens by coincidence.
      • Images that appear consistently across platforms are strong candidates for further investigation outside Maltego Search, such as a reverse image search to surface additional platforms not yet identified.
      Social media profiles
      • Review for name and image consistency across platforms, but treat social media as supporting evidence only — not standalone confirmation of identity.
      • The reason social media carries less weight is structural: most platforms require no identity verification at registration, meaning anyone can sign up under any name.
      • Social media is most useful when combined with stronger signals — consistent name, image, and handle patterns across platforms add breadth to your findings, even if they cannot confirm identity on their own.
      Locations
      • Treat with caution. Location data in Maltego Search typically originates from Google Maps, where it is pulled from reviews and check-ins left by the user. This means a location reference tells you where someone has left a review, not necessarily where they live or work.
      • A single location reference is weak evidence. A consistent pattern of references to the same area across multiple independent sources carries more directional weight, but should still be corroborated before drawing firm conclusions.
      Phone numbers
      • Use as a pivot point to open a secondary search thread rather than as a standalone signal.
      • In some countries, phone numbers can be reassigned when a contract ends — the number is returned to the provider and issued to a new customer. If a phone number surfaces a different individual, this does not necessarily indicate anything suspicious, but should be trated with caution.
      • Always account for possible reassignment before drawing conclusions, and investigate any surfaced number as a separate search to see what additional connections it opens.
      Aliases
      • Run a separate search from every alias surfaced. People frequently reuse handles or variations of their email alias when registering for online services and social media.
      • Alias searches often uncover accounts that are not linked to the original email address and would not otherwise be found — this is one of the most reliable ways to expand the search surface significantly.
      • If an alias search returns no new results, this is itself a useful signal — it suggests the subject does not use a consistent handle across platforms, which may indicate deliberate compartmentalisation.


      Other guides you might find useful:

      Give us your Feedback!