18 Oct 2023

Automating Repetitive Steps in Trust and Safety Investigations with Maltego Machines

Jules Brahms

Routine tasks often consume a large portion of the time of Trust and Safety teams. Conducting the same investigative steps on different persons of interest, overseeing brand protection on corporate domains, or performing regular risk assessments all drain valuable resources.

These repetitive workloads shift the focus away from decision-making and proactive risk management, resulting in internal challenges such as disengagement, reduced productivity, strained resources, and hindered scalability. Externally, they can cause delays during growth or high-demand periods, impacting customer experience and stakeholder perception. Manual handling of these tasks may also introduce errors and inconsistencies, as well as underutilization of skilled professionals’ expertise.

Implementing automation and optimizing processes is therefore crucial to improving operational efficiency and maintaining a positive organizational image. In this article, we’ll demonstrate how to automate some of the common repetitive workloads using Maltego Machines, offering practical examples for your Maltego setup.


How Maltego Automates Trust and Safety Workflows 🔗︎

When conducting an investigation with Maltego, investigators can often execute various Transforms in sequence, using the results from each Transform as the input for the next step. This process may be repetitive and automated across many different investigations.

Methodizing these processes can be hugely beneficial and timesaving for Trust and Safety teams. Maltego makes this achievable through automation using Machines. Machines will repeat a pattern of Transforms you predefined as if you were operating the tool yourself. They can run Transforms both in parallel and sequentially.

To illustrate the use of Maltego, we will first reproduce a scenario in which a threat analyst in a multinational organization wants to periodically conduct brand protection investigations on the corporate top-level domains (TLDs), as well as identify potentially forgotten domains.

Using PayPal as our illustrative example, we’ll first introduce the steps necessary to conduct this investigation, and later showcase how to automate these investigative processes utilizing Maltego Machines to streamline our future periodic brand protection checks.

For additional insights, you can access a downloadable PDF where we demonstrate how to build two other Maltego Machines: one for person of interest investigation and another for tracking counterfeit products.

Launching a Brand Protection Investigation with Maltego 🔗︎

In the first use case, our analyst wishes to conduct a brand protection investigation on the corporate top-level domains (TLDs) and identify potentially forgotten domains.

This entails identifying all TLDs with PayPal as the hostname, determining which of these actually belong to PayPal, and then finding out if there are any unused www DNS names.

This can be easily done in Maltego with a few simple steps:

  • STEP 1

First, we need to ensure that we have the necessary Hub items installed. For this investigation, we will need two Hub items: Maltego Standard Transforms and SSL Certificate Transforms.

  • STEP 2

We will now open a new graph, drag a Domain Entity from the Entity Palette onto it, and change the input value to “paypal.com,” which will serve as the starting point of our investigation.

  • STEP 3

We aim to identify domains with the same hostname but different TLDs. To achieve this, execute the To Domain [Find other TLDs] Transform on the Domain Entity.

This Transform searches for domains observed on the internet with the same hostname but different TLDs.

Maltego retrieved hundreds of results, such as paypal[.]me or paypal[.]tk, some of which are not associated with websites. Our goal is to determine which websites could be parked or engaged in cybersquatting — in other words, registering, trafficking in, or using an Internet domain name with a bad faith intent to profit from the goodwill of a trademark belonging to someone else.

  • STEP 4

We can examine the DNS records to check if there are active websites associated with the domain, using the To Website [Quick lookup] Transform. We want to identify which of these domains could be parked or involved in cybersquatting and which are legitimate websites owned by PayPal.

  • STEP 5

To do so, we need to run the To Certificate Transform on all Website Entities. SSL certificates are a great way to ascertain the domain under the control of a single organization.

The resulting graph shows several PayPal domains with the same DigiCert EV certificate. Others use free SSL certificates, while some do not have SSL certificates at all.

While these steps were relatively easy and quick, they can become repetitive and still consume considerable time to execute, especially if done periodically. Let’s proceed to build a Machine to automate the process and further expedite it.

Automating a Brand Protection Investigation with Maltego Machines 🔗︎

In this demonstration, we assume that our analyst already has both Maltego Standard Transforms and SSL Certificate Transforms installed, so we will directly move to building our Machine by following the steps below.

  • STEP 1

Select the “New Machine” option under the Machines tab in the Maltego menu.

  • STEP 2

The Machine needs to be named and given a unique ID (this is autogenerated by Maltego, but can be changed to whatever you prefer) and an author. You can also add a description if you wish. This can be especially useful if you are planning on sharing the Machine with other users.

  • STEP 3

There are different types of Machines:

  1. Macro Machine: Will only run once when started.
  2. Timer Machine: Runs periodically until stopped.
  3. Blank Machine: A completely clean slate.

For our purpose, a Macro Machine is most suitable.

  • STEP 4

After all the info has been put in, the Machine editor will open automatically.

Machines are written in the Maltego Scripting Language (MSL). When the Machine editor opens, the header contains metadata about the Machine, while the actual Machine content is enclosed in the “start {}” brace. The editor contains some boilerplate code to get started, but we will remove the two example Transforms from the autogenerated code to start.

As a reminder, this is the sequence of Transforms we want to automate:

  1. Domain name
  2. Other TLDs
  3. Website
  4. Certificates

It’s important to note here that each Transform uses the results of the previous Transform run to work with.

If you are interested in learning how to build a Machine that executes several Transforms on the same Entity, head to the free PDF version of this article, which explains how to set up such a Machine.

  • STEP 5

Machines use Transform IDs to determine which Transform to run. We can find the ID on the right-side pane of the Machine editor. We can filter Transforms by Input Entity type and select them from seeds installed in the Transform hub. We can either drag and drop the Transform or double-click it. It will be added to where the cursor is.

  • STEP 6

We want to start with a Domain, so we set the Filter by Input field to Domain. This way, we will only be shown Transforms that run on Domain Entities, ensuring our Machine runs correctly.

Now we find the To Domain (Find other TLDs) [WhoisXML] Transform under the Maltego Wayback Machine header.

  • STEP 7

We will do the same with the other Transform, To Website [Quick Lookup], before changing the Filter by Input to Website and adding the To Certificate Transform.

  • STEP 8

Next, let us click the test button to see if the Machine was set up correctly and can run, and then click save once you see the “success!” notification.

  • STEP 9

We can now use our Machine on the URL Entity by going to the Machines tab in the Transform window and running our Machine.

You will see a couple of out-of-the-box Maltego Machines for network footprinting and your custom Machine. In our example, we, of course, want to run the custom Machine we named Paypal Brand Protection.

  • STEP 10

This immediately ran the Transforms we defined in the Maltego editor.

How to Automate Person of Interest and Resale of Counterfeit Goods Investigations with Maltego 🔗︎

We have just illustrated how automating Transforms can significantly reduce the workload of trust and safety investigators. While this is just an example, you can create custom Machines to automate nearly any repetitive steps in Maltego.

To provide you with more ready examples that you can immediately replicate in your Maltego Client, we have created two additional step-by-step guides for automating two common workflows among Trust and Safety teams, namely:

  • Person of Interest Investigation
  • Resale of Counterfeit Goods Investigation

You can download the PDF below, where you will have the opportunity to follow detailed steps for building and running custom Maltego Machines that will help you explore the online footprint of persons of interest, as well as conduct checks on individuals selling counterfeit company products online in one click.


This resource will equip you with an in-depth understanding of how to effectively use Maltego for these investigations, enabling you to practice building Machines on your own and use them in your daily trust and safety operations.

Download the resource

DE +49
Albania +355
Algeria +213
Andorra +376
Angola +244
Anguilla +1264
Antigua and Barbuda +1268
Argentina +54
Armenia +374
Aruba +297
Australia +61
Austria +43
Azerbaijan +994
Bahamas +1242
Bahrain +973
Bangladesh +880
Barbados +1246
Belarus +375
Belgium +32
Belize +501
Benin +229
Bermuda +1441
Bhutan +975
Bolivia +591
Bosnia Herzegovina +387
Botswana +267
Brazil +55
Brunei +673
Bulgaria +359
Burkina Faso +226
Burundi +257
Cambodia +855
Cameroon +237
Canada +1
Cape Verde Islands +238
Cayman Islands +1345
Central African Republic +236
Chile +56
China +86
Côte d'Ivoire +225
Colombia +57
Comoros +269
Congo +242
Cook Islands +682
Costa Rica +506
Croatia +385
Cuba +53
Cyprus North +90392
Cyprus South +357
Czech Republic +42
Denmark +45
Djibouti +253
Dominica +1809
Dominican Republic +1809
Ecuador +593
Egypt +20
El Salvador +503
Equatorial Guinea +240
Eritrea +291
Estonia +372
Ethiopia +251
Falkland Islands +500
Faroe Islands +298
Fiji +679
Finland +358
France +33
French Guiana +594
French Polynesia +689
Gabon +241
Gambia +220
Georgia +7880
Germany +49
Ghana +233
Gibraltar +350
Greece +30
Greenland +299
Grenada +1473
Guadeloupe +590
Guam +671
Guatemala +502
Guinea +224
Guinea - Bissau +245
Guyana +592
Haiti +509
Honduras +504
Hong Kong +852
Hungary +36
Iceland +354
India +91
Indonesia +62
Iran +98
Iraq +964
Ireland +353
Israel +972
Italy +39
Jamaica +1876
Japan +81
Jordan +962
Kazakhstan +7
Kenya +254
Kiribati +686
Korea North +850
Korea South +82
Kuwait +965
Kyrgyzstan +996
Laos +856
Latvia +371
Lebanon +961
Lesotho +266
Liberia +231
Libya +218
Liechtenstein +417
Lithuania +370
Luxembourg +352
Macao +853
Macedonia +389
Madagascar +261
Malawi +265
Malaysia +60
Maldives +960
Mali +223
Malta +356
Marshall Islands +692
Martinique +596
Mauritania +222
Mayotte +269
Mexico +52
Micronesia +691
Moldova +373
Monaco +377
Mongolia +976
Montserrat +1664
Morocco +212
Mozambique +258
Myanmar +95
Namibia +264
Nauru +674
Nepal +977
Netherlands +31
New Caledonia +687
New Zealand +64
Nicaragua +505
Niger +227
Nigeria +234
Niue +683
Norfolk Islands +672
Northern Marianas +670
Norway +47
Oman +968
Pakistan +92
Palau +680
Panama +507
Papua New Guinea +675
Paraguay +595
Peru +51
Philippines +63
Poland +48
Portugal +351
Puerto Rico +1787
Qatar +974
Reunion +262
Romania +40
Russia +7
Rwanda +250
San Marino +378
Sao Tome & Principe +239
Saudi Arabia +966
Senegal +221
Serbia +381
Seychelles +248
Sierra Leone +232
Singapore +65
Slovak Republic +421
Slovenia +386
Solomon Islands +677
Somalia +252
South Africa +27
Spain +34
Sri Lanka +94
St. Helena +290
St. Kitts +1869
St. Lucia +1758
Sudan +249
Suriname +597
Swaziland +268
Sweden +46
Switzerland +41
Syria +963
Taiwan +886
Tajikstan +7
Thailand +66
Togo +228
Tonga +676
Trinidad & Tobago +1868
Tunisia +216
Turkey +90
Turkmenistan +7
Turkmenistan +993
Turks & Caicos Islands +1649
Tuvalu +688
Uganda +256
UK +44
Ukraine +380
United Arab Emirates +971
Uruguay +598
USA +1
Uzbekistan +7
Vanuatu +678
Vatican City +379
Venezuela +58
Vietnam +84
Virgin Islands - British +84
Virgin Islands - US +84
Wallis & Futuna +681
Yemen +969
Yemen +967
Zambia +260
Zimbabwe +263

By clicking on "Access", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.

Don’t forget to follow us on Twitter, LinkedIn, and Mastodon, and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

About the Author 🔗︎

Jules Brahms 🔗︎

Jules Brahms is a Subject Matter Expert at Maltego, where she supports the trust and safety needs of brands, companies, and platforms, drawing on her experience as a trust and safety professional with a background in incident response, product abuse, and misinformation prevention. In her role, she develops workflows for trust and safety practitioners and conducts training with teams to build capacity in risk assessments, the handling of misinformation and electoral manipulation, and person of interest investigations. Previously, Jules worked as a Subject Matter Expert for online radicalization and misinformation at trust and safety provider ActiveFence, which delivers trust and safety solutions to leading online platforms.

By clicking on "Subscribe", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.