Map a Domain's Digital Footprint

Use Maltego to map a domain's DNS, WHOIS, and infrastructure ownership.

Introduction

30 Second Summary

Every website you visit leaves a trail of digital breadcrumbs. Domain names connect to IP addresses, which connect to network blocks, which connect to the companies that own them. Investigators use these connections to map out who owns what online.

In this project, you will use Maltego Graph Community Edition to investigate a public domain and build a visual map of its entire digital footprint.

What You'll Build

A complete Level 1 network footprint investigation of a public domain using OSINT (Open Source Intelligence) techniques in Maltego.

By the end of this project, you'll have:

A visual graph mapping a domain's DNS hostnames, IP addresses, netblocks, and infrastructure owners.
Hands-on experience running OSINT transforms that chain data discoveries together to uncover hidden relationships.
A saved and encrypted investigation file documenting your Level 1 network footprint.
Secret Mission: Install a third-party OSINT connector and discover subdomains and vulnerability data beyond standard transforms.

Are there any prerequisites?

None. This project includes full setup instructions for Maltego Graph Community Edition. You just need a computer running Windows, macOS, or Linux with at least 8GB of RAM.

Set Up Maltego Graph Community Edition

Before you can investigate a domain's digital footprint, you need the right tool for the job. Maltego Graph Community Edition is a professional OSINT platform that visualizes relationships between data points as an interactive graph.

In this step, you will create a free Maltego account, install the desktop application, and activate it so you are ready to start your investigation.

In this step, get ready to:

Register for a free Maltego ID account.
Download and install Maltego Graph on Windows.
Activate Maltego Graph CE with your Maltego ID.

Register for a Maltego ID

Your Maltego ID is the single login you will use to access Maltego Graph and all related Maltego services. Creating one is free and takes about two minutes.

Open your web browser and navigate to maltego.com.
Click Get Started Now on the homepage.
Fill in your registration details (name, email, and password) to create your Maltego ID.
Check your email inbox for an activation email from Maltego.
Click the activation link in the email to confirm your account.

What is a Maltego ID?

A Maltego ID is a unified login account for all Maltego products and services. It consists of your email address and a password.

Your free Basic plan includes 200 credits per month, which is more than enough for this project.

Activation email not arriving?

Check your spam or junk folder. The email comes from Maltego and may take a minute or two to arrive.

If you still do not see it after five minutes, try registering again with the same email address. Help me troubleshoot my Maltego registration.

Download and install Maltego Graph

Maltego Graph requires Java to run, but the Windows installer bundles it for you. This means you do not need to install Java separately.

Navigate to the Maltego downloads page at maltego.com/downloads.
Confirm Windows is selected as the operating system at the top of the page.
In the Extension dropdown, select the .exe + Java option.
Click Download to begin the download.
Once the download is complete, double-click the installer file to launch the Maltego Setup Wizard.
Follow the prompts in the Setup Wizard, accepting the default options at each screen until installation completes.

Why the .exe + Java bundle?

Maltego requires a 64-bit Java runtime (version 8, 11, or 17) to operate. The bundled installer includes Java so you do not need to find, download, or configure it yourself.

macOS or Linux?

Maltego also runs on macOS and Linux. On macOS, download the .dmg file and drag Maltego into your Applications folder. On Linux, choose the .deb or .rpm package for your distribution.

Installation failing or freezing?

Make sure you have at least 4 GB of free disk space and 8 GB of RAM on your machine. Close other heavy applications before running the installer.

If Windows SmartScreen blocks the installer, click More info and then Run anyway. Help me fix my Maltego installation.

Activate Maltego Graph CE

With Maltego installed, you need to link it to your Maltego ID so it activates the free Community Edition plan.

Press the Windows key to open your search bar.
Type Maltego and press Enter to launch the application.
When the License Agreement appears, read and accept it to continue.
On the activation screen, click Browser Login.
Your default browser will open a Maltego login page. Sign in with the Maltego ID email and password you created earlier.
Once authenticated, switch back to the Maltego Graph window. It will confirm activation and bring you to the Maltego start page.

What should I see?

After successful activation, you land on the Maltego start page. Your Basic plan is now active with 200 credits per month. You are ready to create your first investigation graph.

Browser Login not working?

Make sure you are signing into the browser with the same email you used to register your Maltego ID. If your browser blocks pop-ups, allow pop-ups for the Maltego domain and try again.

If your browser login completes but Maltego still shows the activation screen, close and reopen Maltego Graph, then try the Browser Login again. Help me activate Maltego Graph.

Your investigation environment is ready. Next up, you will create your first graph and place a domain entity on the canvas to begin your reconnaissance.

Create Your First Graph and Add a Domain Entity

Your Maltego environment is ready to go. Now it's time to start your investigation.

Every OSINT investigation in Maltego begins with a graph. A graph is a visual workspace where you place entities (pieces of data like domains, IP addresses, or people) and then run transforms to discover connections between them.

In this step, get ready to:

Create a new blank graph in Maltego.
Add a Domain Entity and set it to your investigation target.
Explore the Transform menu to see what data-gathering options are available.

Create a new graph

A graph is your investigation canvas. Everything you discover will appear here as connected nodes.

Click the Maltego button in the top-left corner of the window.
Choose New from the main menu.

A blank graph canvas opens in the main area of the window.

What is a graph in Maltego?

Think of the graph as a whiteboard where every sticky note is a piece of data (an entity) and every line connecting them is a relationship you've discovered. As you run transforms throughout this project, the graph will fill with nodes and connections that map your target's digital footprint.

Don't see the Maltego button?

The Maltego button is a small icon in the very top-left corner of the application window, above the toolbar. It opens the main application menu (similar to a File menu).

If your window is maximized and you still cannot find it, try resizing the window slightly to refresh the UI.

Help me find the Maltego button to create a new graph.

Add a Domain Entity to the graph

Entities are the building blocks of any Maltego investigation. A Domain Entity represents a website domain name, which is your starting point for this investigation.

In the Entity Palette on the left side of the window, type Domain in the search box.
Drag the Domain entity from the palette onto the blank graph canvas.
Double-click the entity value on the graph (or press F2) to edit it.
Replace the default value maltego.com with your investigation target (e.g., gnu.org).
Press Enter to confirm the new value.

Your graph now shows a single Domain Entity with your chosen target domain displayed as its label.

Why gnu.org?

This project uses gnu.org as an example because it is a well-established public domain with rich DNS infrastructure. It produces meaningful results without needing paid data sources.

You can substitute any domain you have permission to investigate. Avoid domains you do not own or have authorization to research in a professional context.

Can't find the Entity Palette?

The Entity Palette is a panel on the left side of the graph canvas. If it is not visible, check that you have a graph open (not just the start page). The palette only appears when you are viewing a graph.

Help me locate the Entity Palette in Maltego.

Explore the Transform menu

Transforms are the actions that gather new data from your entities. Before running any transforms, take a moment to see what is available.

Right-click on your Domain Entity to open the Transform menu.
Notice the Transform Sets (marked with a + icon) that group related transforms together.
Type a keyword (like DNS or whois) into the search box at the top of the Transform menu to filter the list.
Press Escape to close the menu without running anything.

What are transforms?

A transform takes an entity as input, queries an external data source (like a DNS server or WHOIS database), and returns new entities that are connected to the original. This is how your graph grows from a single domain into a full map of infrastructure.

Maltego ships with over 150 standard transforms for gathering data from DNS servers, search engines, social networks, and APIs. In the next steps, you will use several of these to uncover your target domain's footprint.

Keep an eye on your credits

Your Basic plan includes 200 credits per month. Each transform run costs credits. You have plenty for this project, but avoid running transforms repeatedly on the same entity.

Your graph is set up and you know where to find transforms. Next, you will run your first transforms to extract WHOIS contacts and discover DNS hostnames hiding behind your target domain.

Extract WHOIS Contacts and DNS Hostnames

Your graph currently has a single Domain Entity sitting alone on the canvas. That is about to change.

In this step, you will pull contact information from the domain's WHOIS registration record and enumerate its DNS hostnames. By the end, your graph will show real people, real servers, and real IP addresses all connected to a single domain.

In this step, get ready to:

Extract email addresses and phone numbers from WHOIS records.
Discover active DNS hostnames using common prefix enumeration.
Resolve every discovered hostname to its IP address.

Run WHOIS transforms

Every domain registered on the internet has a WHOIS record containing administrative contact details. These details can reveal who manages the domain, their email address, and sometimes their phone number.

Right-click on your Domain Entity in the graph.
In the Transform menu that appears, expand the Domain owner detail Transform Set (marked with a + icon).
Click To Email Address [From whois info] to run the transform.

After a few seconds, new Email Address entities appear on the graph, connected to your Domain Entity by lines.

Right-click on your Domain Entity again.
Expand the Domain owner detail Transform Set.
Click To Phone Numbers [From whois info] to extract any phone numbers from the WHOIS record.

What is a Transform?

A Transform is a query that takes one entity as input and returns new, related entities as output. Think of it as asking a question about a piece of data and getting answers back as new nodes on your graph.

Each transform you run consumes credits from your monthly allowance of 200. The WHOIS transforms query public registration databases to find the people and organizations behind a domain.

What if no phone numbers appear?

Many modern WHOIS records have privacy protection enabled, which hides contact details behind a proxy service. If no phone numbers appear, that is a valid finding. It tells you the domain owner is using WHOIS privacy protection.

Enumerate DNS hostnames

DNS hostname enumeration tests common prefixes (like mail, ns, ftp, admin, ssh) against your target domain to discover which servers are active. This reveals the infrastructure behind the domain.

Right-click on your Domain Entity.
In the Transform menu, type DNS into the search box at the top.
Click To DNS Name [Find common DNS names] to run the enumeration.

Multiple DNS Name entities appear on your graph. Each one represents an active hostname that responded when Maltego tested a common prefix against your domain.

What prefixes does this transform test?

The transform tests prefixes including mail, mx, ns, ftp, webmail, web, gateway, secure, intranet, extranet, smtp, pop, ns1, mx1, email, admin, dmz, blog, dns, forum, ntp, pub, route, sql, ssh, webaccess, xml, and imap. Any prefix that resolves to a valid DNS record becomes a new entity on your graph.

Only seeing a few DNS Names?

The Basic plan limits results to 24 per transform run. If your target domain has minimal infrastructure, fewer results are expected. This is normal for smaller organizations.

If you see zero results, make sure you right-clicked the Domain Entity specifically, not one of the email or phone entities you just created.

Why am I getting no DNS results from my domain entity?

Resolve hostnames to IP addresses

Each DNS hostname points to a physical server somewhere on the internet. Resolving hostnames to IP addresses tells you where that infrastructure actually lives.

Click and drag on the graph canvas to draw a selection box around all the DNS Name entities.
Right-click on any one of the selected DNS Name entities.
Click To IP Address [DNS] to resolve each hostname to its IP address via DNS lookup.

New IP Address entities appear on your graph, each linked to the DNS Name that resolved to it. Some hostnames may share the same IP address, which tells you they live on the same server.

Why select multiple entities at once?

Running a transform on multiple selected entities applies it to all of them in one action. This saves you from right-clicking each DNS Name individually. Maltego applies the transform to every selected entity of the matching type.

Transform option not appearing?

If you do not see the To IP Address [DNS] option, make sure you selected the DNS Name entities, not the Domain Entity or Email entities. Transforms are context-sensitive and only show options relevant to the selected entity type.

Why can I not see the DNS-to-IP transform in my right-click menu?

Your graph now reveals the people behind the domain and the servers that power it. Next up, you will trace those IP addresses back to the companies that own the underlying network infrastructure.

Map the Infrastructure Ownership Chain

Your graph now shows DNS hostnames, IP addresses, and WHOIS contact details. These are valuable, but the real investigative power comes from tracing who owns the infrastructure behind those IP addresses.

In this step, you will follow the ownership chain from IP addresses up through network blocks to the companies that control them. This is the core of a Level 1 network footprint investigation.

In this step, get ready to:

Derive netblocks from IP addresses using natural boundaries.
Identify Autonomous System numbers from Regional Internet Registry databases.
Reveal the companies that own each piece of infrastructure.

Derive netblocks from IPs

Every IP address on the internet belongs to a netblock. A netblock is a range of IP addresses allocated together to a single organization. Identifying the netblock tells you which chunk of the internet your target's server lives in.

Select all IP Address entities on your graph by clicking and dragging your mouse to draw a selection box around them.
Right-click on one of the selected IP Address entities to open the Transform menu.
Search for Netblock in the transform search box.
Click To Netblock [Using natural boundaries] to run the transform.

What does this transform do?

This transform divides IP address space into blocks of 256 IPs and returns the block where each given IP fits. It determines where the natural network boundaries fall around your target's addresses.

New Netblock entities will appear on your graph connected to the IP addresses they contain.

You should see new Netblock entities appear on your graph, each connected by a line to the IP Address entities that fall within their range.

No netblocks appearing?

Make sure you selected all IP Address entities before right-clicking. If you right-click on an entity that is not selected, the transform only runs on that single entity.

Check that you ran the transform on IP Address entities specifically, not on DNS Name entities. The netblock transform requires IP addresses as input.

Help me figure out why my netblock transform isn't returning results.

Identify Autonomous System numbers

Each netblock is managed by an Autonomous System (AS). An AS is a large network or group of networks under a single administrative policy. Finding the AS number tells you which large-scale network operator controls the infrastructure.

Select all the Netblock entities on your graph.
Right-click on one of the selected Netblock entities.
Click To AS Number to run the transform.

What does this transform do?

This transform queries Regional Internet Registry (RIR) databases to find which Autonomous System owns each netblock. RIR databases are the authoritative records of who controls which parts of the internet's address space.

New AS Number entities should appear on your graph, connected to the Netblock entities they manage.

Not seeing AS Number entities?

Confirm you selected the Netblock entities, not the IP Address entities. The AS Number transform takes netblocks as its input.

If some netblocks do not return an AS Number, it may be because the RIR database does not have a record for that specific block. This is normal for some private or reserved ranges.

Help me troubleshoot my AS Number transform.

Reveal infrastructure owners

The final link in the chain is identifying which company or organization actually owns each Autonomous System. This is the payoff of the entire investigation.

Select all the AS Number entities on your graph.
Right-click on one of the selected AS Number entities.
Click To Company [Owner] to run the transform.

What does this transform do?

This transform extracts the owner information of each Autonomous System from RIR databases. The result is the actual company name that controls that portion of the internet.

Your graph now shows the complete ownership chain: Domain → DNS Names → IP Addresses → Netblocks → AS Numbers → Companies.

Company entities should now appear on your graph. You can see exactly which organizations host the infrastructure behind your target domain.

Why does this chain matter for OSINT?

Knowing who owns the infrastructure tells an investigator where the target's services are physically hosted. If a domain uses multiple hosting providers, that reveals redundancy strategies, CDN usage, or third-party dependencies.

This ownership chain is the foundation of a Level 1 network footprint. Everything is derived from publicly available DNS and RIR records.

Not seeing company names?

Make sure you ran the transform on AS Number entities, not Netblock entities. The company lookup requires AS Numbers as input.

Remember that Maltego CE limits results to 24 per transform run. If you have many AS Numbers, some results may be truncated.

Help me understand why my company transform isn't working.

Your graph now tells a complete story from a single domain name all the way to the companies that control its infrastructure. Next up, you will analyze these relationships, automate the process with Maltego Machines, and save your investigation securely.

Analyze and Save Your Investigation

Your graph now shows the complete chain from a single domain all the way to the companies that own the underlying infrastructure. This is a real investigator's view of a target's digital presence.

In this final step, you will analyze the relationships your graph reveals, automate the entire investigation with a built-in Machine, and save your work as an encrypted file for secure storage.

In this step, get ready to:

Analyze the visual relationships in your graph to identify hosting companies, netblocks, and unexpected connections.
Run the Footprint L1 Machine to automate the entire investigation sequence.
Save and encrypt your investigation as a protected .mtgx file.

Read your graph

A graph is only useful if you can read the story it tells. Each connection between entities represents a real-world relationship you have discovered through OSINT transforms.

Look at the Company entities on your graph. These are the organizations that own the infrastructure hosting your target domain.
Count the distinct Netblock entities. Each one represents a separate block of 256 IP addresses.
Look for unexpected connections. Does the domain use infrastructure owned by multiple different companies? Are any IP addresses shared across different DNS hostnames?
Reorganize your graph for clarity by clicking the View menu and selecting a layout option (such as Block Layout or Hierarchical Layout) to arrange entities so the relationships are easier to follow.

What should I see?

Your graph should show a clear hierarchy flowing from your Domain Entity outward to DNS Names, then IP Addresses, Netblocks, AS Numbers, and finally Company entities. WHOIS contact entities (emails, phone numbers) branch off directly from the Domain.

If you used gnu.org as your target, you will likely see infrastructure owned by organizations involved in free software hosting.

Automate with Machines

Maltego Machines are pre-built automation sequences that run multiple transforms in order. The Footprint L1 Machine performs the same investigation you just did manually, all in one click.

Click on your original Domain Entity to select it.
In the top menu bar, click Machines.
Select Footprint L1.
Wait for the Machine to finish running. It will execute the entire Level 1 footprinting sequence automatically: Domain to DNS Names, DNS Names to IPs, IPs to Netblocks, Netblocks to AS Numbers, and AS Numbers to Companies.
Compare the Machine's output to your manual results. Look for any new entities the Machine discovered that you missed, or vice versa.

Why run the Machine if I already did this manually?

Running the investigation manually first teaches you what each transform does and how entities connect. The Machine confirms your work and may catch additional results you missed.

In real investigations, analysts often run Machines first for speed, then follow up with targeted manual transforms on interesting entities.

Machine not appearing in the menu?

Make sure your Domain Entity is selected (click it once so it is highlighted) before opening the Machines menu. Some Machines only appear when the correct entity type is selected.

If you have run many transforms already, you may be close to your 200 credits/month limit on the Basic plan. Check your credit balance in the bottom-right corner of the Maltego window.

Help me troubleshoot why the Footprint L1 Machine is not available in Maltego.

Save and encrypt your graph

Investigation graphs can contain sensitive reconnaissance data. Maltego lets you encrypt saved files with a password so only you can reopen them.

Click the Maltego button in the top-left corner of the window.
Click Save As.
Choose a location on your computer (such as your Desktop) and enter a descriptive filename.
Select the Encrypt option.
Enter a password you will remember. This password will be required every time you reopen the file.
Click Save.

Your investigation is now saved as an encrypted .mtgx file. You can reopen it anytime by double-clicking the file or using the Maltego button > Open.

Why encrypt?

OSINT investigation files can reveal what you know about a target's infrastructure. Encryption ensures that if the file is shared accidentally or a device is compromised, the data remains protected.

Don't see the Encrypt option?

Make sure you are using Save As (not just Save). The Encrypt checkbox appears in the Save As dialog, not when saving over an existing file.

Help me find the encrypt option when saving my Maltego graph.

Secret mission

Expand Your Investigation with Social Links CE

Your Level 1 footprint revealed the domain's core infrastructure. But what if there are subdomains hiding beyond standard DNS prefix testing? Install a free third-party OSINT connector and uncover subdomains and vulnerability data that standard transforms miss.

Clean Up Your Resources

This project runs entirely on your local machine using Maltego's free Basic plan. There are no ongoing cloud costs or subscriptions to worry about.

Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

Resources you used:

Maltego Graph CE desktop application (installed via Windows .exe + Java bundle).
Saved encrypted .mtgx investigation file (local file on your machine).

Keep everything running

No action needed. Choose this if you plan to continue investigating or want to revisit your graph later.

Maltego Graph CE stays installed and ready to launch from your Start menu.
Your encrypted .mtgx file remains saved wherever you stored it.
Your free Maltego ID account stays active with 200 credits refreshing monthly.
The Social Links CE connector remains installed inside Maltego for future use.

Pause - I'll come back to this later

Close Maltego to free up system memory. Your files and account stay intact for when you return.

Close Maltego Graph by clicking the X button in the top-right corner or pressing Alt+F4.
Your saved .mtgx file and Maltego installation remain untouched.
When you want to resume, launch Maltego and open your saved graph file.

Delete - I don't want to use this again

Remove Maltego and your investigation file from your machine entirely.

Delete your saved .mtgx investigation file. Navigate to the folder where you saved it in File Explorer, right-click the file, and select Delete.
Uninstall Maltego Graph CE from your system.
Press the Windows key to open your search bar.
Type Add or remove programs and press Enter.
Search for Maltego in the app list.
Click the three-dot menu next to Maltego and select Uninstall. Follow the prompts to complete removal.

What about your Maltego ID account?

Your free Maltego ID account remains active but costs nothing. It does not store any of your investigation data. If you want to delete your account in the future, check Maltego's account settings page for the latest instructions.

Nice Work!

You just conducted a professional OSINT investigation using the same tool that intelligence analysts and cybersecurity investigators use worldwide. Starting from a single domain name, you uncovered an entire network of infrastructure relationships.

You've learned how to:

Built a visual link-analysis graph mapping a domain's complete Level 1 network footprint, including DNS hostnames, IP addresses, WHOIS contacts, netblocks, and AS owners.
Ran OSINT transforms to chain data discoveries together, extracting WHOIS records, enumerating DNS names, resolving IPs, and mapping the full infrastructure ownership chain from netblocks to companies.
Automated a full investigation using Maltego Machines and saved an encrypted .mtgx investigation file for secure storage.
Installed a third-party OSINT connector (Social Links CE) and discovered additional subdomains and vulnerability data beyond standard transforms.

Ready to quiz yourself?