23 Dec 2020

Investigating Companies with OpenCorporates and Maltego

Maltego Team

With the availability of OpenCorporates’ extensive database of global company information, investigators can leverage Maltego to explore beneficial ownership, money laundering, and financial crimes, and conduct comprehensive corporate investigations to support their due diligence and trust and safety efforts.

OpenCorporates Transforms are accessible to all investigators on Maltego Professional or Maltego Organization plans.

Follow along to learn how to get started or watch our deep dive where we used OpenCorporates and OSINT to identify potential human trafficking organizations!


Getting Started with OpenCorporates Transforms in Maltego 🔗︎

Typically, an investigation into a company starts with a name. Drag the Company Entity onto your graph from the Entity Palette and double-click its value to enter the name of the company you want to investigate. Alternatively, you could also use any Company or Organization Entity that is already on one of your graphs, for example, one resulting from a WHOIS query or network footprint.

Company Entity in Maltego

Searching for Companies in OpenCorporates 🔗︎

To look up the company in OpenCorporates, run the Search Companies [OpenCorporates] Transform.

Search Companies [OpenCorporates] Transform

You may specify additional search filters using the Transform Settings popup, but, except for the API key field, all of these are optional and can simply be left blank. For details on what these filters mean and how to use them, please see the OpenCorporates API documentation.

API key pop up

After running this Transform, you will usually receive several OpenCorporates Company Entities returned to the graph which match your query. If many companies matched your query, these may be returned as a collection node, such as in the example below. In this case, a relevant candidate was selected from the results and pinned in order to remove it from the collection node.

OpenCorporates Company Entities

To fetch the address of the company and return it as a Location Entity, run the To Address [OpenCorporates] Transform.

To Address [OpenCorporates] Transform

You may notice that after running this Transform on the OpenCorporates Company Entity, a blue dot is added to it. This is used to indicate that another API call to OpenCorporates was made to fetch all available details about the company, and that these full details are now populated on the Entities’ properties. This happens automatically, and generally only once per Entity: Once the properties are populated, the Transform server will not duplicate this API request for that particular Entity next time, in order to use less of your OpenCorporates API request quota. However, note that the server does not cache this information – if you run the same sequence of Transforms on a new graph, the same number of API calls may be made.

The resulting Location Entity will often only display a city and/or country in its value. By inspecting the properties, it is possible to see that in this case, a street level address was in fact returned (in which the city was not fully parsed by OpenCorporates).

Location result

Given this street-level address, it is possible to now run a reverse address search to see what other companies are registered at the same location. For this, use the Search Companies at this Address [OpenCorporates] Transform on the Location Entity.

Search Companies at this Address [OpenCorporates] Transform

In the example case, quite a few more Wirecard legal entities are found to be registered at the same address, which is expected given that the starting point of this investigation was Wirecard’s main “headquarters” legal entity.

Finding and Mapping Officers of Companies 🔗︎

Some of the returned results do not share any obvious affiliation with Wirecard based on their name alone. To pick an example, one of these companies is “PAYShield Services GmbH”. It’s possible to investigate further connections between this company and “Wirecard AG” by inspecting the registered officers of each respective company. Switching back to block layout, running the To Officers [OpenCorporates] Transform on both companies yields the following result:

To Officers [OpenCorporates] Transform

There are a few duplicated names here, however none of the Entities were automatically merged. With respect to Maltego, this is unfortunately a built-in limitation of the way data is represented in OpenCorporates. Each officer of a company has a different OpenCorporates ID, and no disambiguation is made to determine whether an officer is the same person as an officer in another company, so they are assumed to be different people in every case, to be safe.

While this is a slightly inconvenient limitation, it is relatively easily to get around by manually merging OpenCorporates Officer Entities who can, with reasonably certainty, be assumed to be the same person. This results in the following graph:

Merging Officer Entities

Finding Other (Possibly) Connected Companies to an Officer 🔗︎

Finally, we want to present a practical workflow that results from the limitation described above. Since officers are not merged in OpenCorporates, a bit of extra work is required to more fully map the network of companies a given person may be involved in. The basic sequence of steps to follow is:

  1. Start with the Person or OpenCorporates Officer of interest
  2. Run the Search Officers [OpenCorporates] Transform
  3. For all relevant results, run the To Company [OpenCorporates] Transform
  4. Merge the previously returned OpenCorporates Officer Entities to clean up the graph again

Continuing the above example, this process looks as follows. First, a search for officers is run:

Search Officers [OpenCorporates]

Next, each result is pivoted to the associated company:

To Company [OpenCorporates] Transform

Finally, after the companies are returned, the duplicate officers are merged:

Merging duplicated officer results

Merged Entity

This results in the structure we set out to visualize.

Real-Life Investigation with OpenCorporates and Maltego 🔗︎

For more insights and step-by-step guidance, you can watch our deep dive session where Maltego intelligence expert, Daphnée Aguilar, and Rebecca Lee, Chief Impact Officer at OpenCorporates demonstrate a detailed investigation using OSINT, infrastructure data, personal identifier data, and OpenCorporates’ global legal entity database. Fill out the form below to watch the full recording!

Download the resource

DE +49
Albania +355
Algeria +213
Andorra +376
Angola +244
Anguilla +1264
Antigua And Barbuda +1268
Argentina +54
Armenia +374
Aruba +297
Australia +61
Austria +43
Azerbaijan +994
Bahamas +1242
Bahrain +973
Bangladesh +880
Barbados +1246
Belarus +375
Belgium +32
Belize +501
Benin +229
Bermuda +1441
Bhutan +975
Bolivia +591
Bosnia and Herzegovina +387
Botswana +267
Brazil +55
Brunei Darussalam +673
Bulgaria +359
Burkina Faso +226
Burundi +257
Cambodia +855
Cameroon +237
Canada +1
Cape Verde +238
Cayman Islands +1345
Central African Republic +236
Chile +56
China +86
Cote d'Ivoire +225
Colombia +57
Comoros +269
Congo +242
Cook Islands +682
Costa Rica +506
Croatia +385
Cuba +53
Cyprus +90392
Czech Republic +42
Denmark +45
Djibouti +253
Dominica +1809
Dominican Republic +1809
Ecuador +593
Egypt +20
El Salvador +503
Equatorial Guinea +240
Eritrea +291
Estonia +372
Ethiopia +251
Falkland Islands (Malvinas) +500
Faroe Islands +298
Fiji +679
Finland +358
France +33
French Guiana +594
French Polynesia +689
Gabon +241
Gambia +220
Georgia +7880
Germany +49
Ghana +233
Gibraltar +350
Greece +30
Greenland +299
Grenada +1473
Guadeloupe +590
Guam +671
Guatemala +502
Guinea +224
Guinea-Bissau +245
Guyana +592
Haiti +509
Honduras +504
Hong Kong +852
Hungary +36
Iceland +354
India +91
Indonesia +62
Iran, Islamic Republic of +98
Iraq +964
Ireland +353
Israel +972
Italy +39
Jamaica +1876
Japan +81
Jordan +962
Kazakhstan +7
Kenya +254
Kiribati +686
Korea, Democratic People's Republic of +850
Korea, Republic of +82
Kuwait +965
Kyrgyzstan +996
Lao People's Democratic Republic +856
Latvia +371
Lebanon +961
Lesotho +266
Liberia +231
Libyan Arab Jamahiriya +218
Liechtenstein +417
Lithuania +370
Luxembourg +352
Macao +853
Macedonia, the former Yugoslav Republic of +389
Madagascar +261
Malawi +265
Malaysia +60
Maldives +960
Mali +223
Malta +356
Marshall Islands +692
Martinique +596
Mauritania +222
Mauritius +230
Mayotte +269
Mexico +52
Micronesia, Federated States of +691
Moldova, Republic of +373
Monaco +377
Mongolia +976
Montserrat +1664
Morocco +212
Mozambique +258
Myanmar +95
Namibia +264
Nauru +674
Nepal +977
Netherlands +31
New Caledonia +687
New Zealand +64
Nicaragua +505
Niger +227
Nigeria +234
Niue +683
Norfolk Island +672
Northern Mariana Islands +670
Norway +47
Oman +968
Pakistan +92
Palau +680
Panama +507
Papua New Guinea +675
Paraguay +595
Peru +51
Philippines +63
Poland +48
Portugal +351
Puerto Rico +1787
Qatar +974
Reunion +262
Romania +40
Russian Federation +7
Rwanda +250
San Marino +378
Sao Tome and Principe +239
Saudi Arabia +966
Senegal +221
Serbia +381
Seychelles +248
Sierra Leone +232
Singapore +65
Slovakia +421
Slovenia +386
Solomon Islands +677
Somalia +252
South Africa +27
Spain +34
Sri Lanka +94
Saint Helena +290
Saint Kitts and Nevis +1869
Saint Lucia +1758
Sudan +249
Suriname +597
Swaziland +268
Sweden +46
Switzerland +41
Syrian Arab Republic +963
Taiwan +886
Tajikistan +7
Thailand +66
Togo +228
Tonga +676
Trinidad and Tobago +1868
Tunisia +216
Turkey +90
Turkmenistan +993
Turks and Caicos Islands +1649
Tuvalu +688
Uganda +256
United Kingdom +44
Ukraine +380
United Arab Emirates +971
Uruguay +598
United States +1
Uzbekistan +7
Vanuatu +678
Holy See (Vatican City State) +379
Venezuela +58
Viet Nam +84
Virgin Islands, British +84
Virgin Islands, U.S. +84
Wallis and Futuna +681
Yemen +967
Zambia +260
Zimbabwe +263

By clicking on "Access", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.

Don’t forget to follow us on Twitter and LinkedIn or subscribe to our email newsletter to stay tuned for more product and Transform updates.

By clicking on "Subscribe", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.