MALTEGO
OSINT RELATIONSHIP MAPPING — TRAINING ENVIRONMENT
MODULE 05 — DOMAIN · EMAIL · PERSON · INFRASTRUCTURE
Loading entity transforms...

OBJECTIVES

Run DNS transforms on apex-systems.com
Discover all subdomains (4 total)
Run MX + NS record transforms
Resolve IPs for discovered hosts
Discover email addresses (3 total)
Map people to email addresses
Correlate ASN / network owner
Find social media profiles
Run whois + theHarvester in terminal
Submit OSINT report
🕸️
Maltego
💻
Terminal
📖
Reference
📝
Notepad
📋
OSINT Report
OSINT LAB
Maltego
Terminal
Reference
Notepad
Report
--:--:--
PHASE 1 — SEED ENTITY
MISSION BRIEF

MISSION BRIEFING

OSINT INVESTIGATION — APEX SYSTEMS INC.

SCENARIO

You are an OSINT analyst tasked with mapping the full digital footprint of Apex Systems Inc. using Maltego. Starting from a single domain seed, you must enumerate all related domains, subdomains, IP addresses, email addresses, personnel, and infrastructure — then document relationships between them.

SEED ENTITY

Domain: apex-systems.com

The Maltego canvas already has this domain planted. Right-click it (or click it to select, then use the detail panel) to run transforms and begin building the graph.

WHAT TO DISCOVER

Entity TypeExpected Finds
Subdomains4 subdomains
IP Addresses6 IPs
MX Records2 mail servers
NS Records2 nameservers
Email Addresses3 emails
People3 personnel
ASN / Network1 ASN block
Social Profiles2 profiles

PHASES

  • Phase 1 — Seed the domain entity
  • Phase 2 — DNS enumeration (subdomains, MX, NS)
  • Phase 3 — IP resolution + ASN lookup
  • Phase 4 — Email + people discovery
  • Phase 5 — Social media correlation
  • Phase 6 — Terminal verification (whois, dig)
  • Phase 7 — OSINT report

HOW TO USE MALTEGO

  • Click a node to select it and see details + available transforms in the right panel
  • Right-click a node to see the context menu with transform options
  • Run transforms to discover new related entities — they animate onto the canvas with connecting edges
  • Drag nodes to rearrange the graph
  • Each transform can only be run once per node
MALTEGO CE — OSINT GRAPH — apex-systems.com
Entities: 1 Links: 0
100%
ENTITY TYPES
Domain
Subdomain
IP Address
Email
Person
MX Record
NS Record
ASN / Netblock
Social Profile
LEGEND
Click = select
Right-click = transforms
Drag = move node
RUN TRANSFORM
🗑Delete Entity
ENTITY DETAIL
Click a node to inspect it and run transforms
TERMINAL — analyst@osint:~$
analyst@osint:~$ # OSINT Terminal — use whois, dig, theHarvester, curl
analyst@osint:~$ # Type "help" for available commands
analyst@osint:~$
REFERENCE — MALTEGO / OSINT
MALTEGO TRANSFORMS
Domain → DNS
Right-click a domain node → DNS Records to enumerate subdomains, MX, NS, and A records.
Domain / IP → Resolve
Resolve hostname to IP, or reverse-lookup IP to hostnames. Reveals infrastructure.
Domain → Emails
Harvests email addresses associated with a domain from public sources.
Email → Person
Maps email addresses to named individuals using OSINT lookups.
IP → ASN / Netblock
Identifies the Autonomous System Number and registered network block for an IP.
Person → Social
Attempts to find LinkedIn, Twitter/X, and other social media profiles for a named person.
TERMINAL COMMANDS
CommandPurpose
whois apex-systems.comRegistrar, org, dates
dig apex-systems.com ANYAll DNS records
dig MX apex-systems.comMail servers
dig NS apex-systems.comNameservers
theHarvester -d apex-systems.com -b allEmail + subdomain harvest
curl -I https://apex-systems.comHTTP headers
nslookup mail.apex-systems.comResolve hostname
ENTITY TYPES
TypeDescription
DomainRoot domain (apex-systems.com)
Subdomainmail, vpn, dev, api…
IPIPv4 host address
MXMail exchange record
NSAuthoritative nameserver
EmailAddress associated with domain
PersonIndividual linked to email / social
ASNNetwork block / ISP / hosting
SocialLinkedIn, Twitter/X profile
OSINT METHODOLOGY
1. Start with a single seed entity (domain)
2. Run transforms to expand the graph outward
3. Each new entity can itself be pivoted on
4. Look for unexpected connections (shared IPs, common registrars, overlapping email patterns)
5. Document all findings with confidence levels
NOTEPAD — OSINT SCRATCHPAD
OSINT REPORT — APEX SYSTEMS INC.
TARGET PROFILE
DNS FINDINGS
PEOPLE & EMAILS
RISK ASSESSMENT
Score: 0 / 10