Register for our next deep dive! Learn how to equip your team with strategies and tools to detect and dismantle organized crime on Thursday, July 25, 2024, at 16:00 CET.Register now! close
01 Dec 2023

Staying Anonymous During Your Investigation with Maltego

Maltego Team

Anonymity is not a choice for investigators – it’s a necessity. The reasons extend far beyond personal safety and weave into the very fabric of successful investigative work.

In this guide, we focus on the dangers of exposure when investigating fraud or conducting corporate investigations for the investigators, the company they work for, the clients they serve, and the success of their investigations.

In the later part, we will share a cheat sheet that outlines the measures that each investigator should take to protect themselves and their organization when using OSINT and explain how Maltego can help maintain anonymity throughout the entire operation.

Consequences of Data Exposure on the Entire Operation 🔗︎

The internet never forgets, and retracting shared information is practically impossible. Compromising an investigator’s identity or revealing that a target is under scrutiny can affect operations that could be ongoing for weeks or months.

The Domino Effect of Exposure 🔗︎

When adversaries become aware they are being monitored, their responses can lead to serious consequences.

  • Evidence Tampering and Loss

When bad actors realize their activities or accounts are under scrutiny, their immediate reaction often involves erasing their digital footprints. This can range from deleting incriminating accounts and information to moving their operations to more underground or obscure online spaces, or even offline. This hampers investigations and risks the loss of crucial evidence, particularly if it hasn’t been adequately preserved through downloads, screenshots, or other means.

  • Physical Threats to Investigators

Beyond digital threats, there have been doxing incidents targeting employees involved in fraud management, brand investigations, and similar fields.

  • Compromised Company Security

Engaging with websites or sources riddled with malware or other privacy-intrusive technology without adequate precautions can lead to the compromise of sensitive company data. This not only affects the investigative team, but also jeopardizes the security of the company’s entire infrastructure and its clients or partners.

There are tried-and-true measures you can take to maintain anonymity at each stage of your investigation. Download your cheat sheet with do’s and don’ts for every investigator now.

Common Data Exposure Scenarios You Should Avoid 🔗︎

Investigating the roots of data exposure reveals a mix of factors stemming from an inadequate toolkit, insufficient policies and best practices, and a lack of training or awareness. Even simple complacency, leading to sloppy habits and time pressure, can contribute to these vulnerabilities.

Each of these elements, in isolation or combined, can inadvertently open the door to exposing your identity or revealing information about your company. Let’s look at some examples.

Social Media Oversights:

  • Scenario: Inadvertently alerting the person of interest when investigating them on social media.
  • Cause: Using a personal or easily traceable account instead of a carefully managed sock puppet account.
  • Example: Viewing a person of interest’s profile on platforms that notify users of profile visits can lead to exposure or accidental interactions like following or liking a post can raise alarms.

Find out how to carry out your person of interest investigations with Maltego with this step-by-step video guide, and download your cheat sheet for a person of interest workflow.

Web Browsing Vulnerabilities:

  • Scenario: Accessing unknown websites. A mere URL access can reveal an investigator’s IP address and other digital footprints.
  • Cause: Insufficient use of secure browsing tools and techniques that leads to exposure of device ID, system name, geolocation, and browser details.
  • Example: Without proper safeguards, visiting a new forum or website might result in cookies tracking the investigator.

Process and Technology Gaps:

  • Scenario: Inadequate processes and technology used that create vulnerabilities during investigations.
  • Cause: Lack of proper protocols for new or unfamiliar digital environments can lead investigators to improvise, increasing the risk of exposure.
  • Example: Encountering a new type of online platform without a predefined approach can lead to insecure browsing practices.

Human Error and Complacency:

  • Scenario: Common investigator lapses or oversights.
  • Cause: Complacency, time pressure, or lack of awareness can result in careless actions.
  • Example: Liking an old photo of a target, even using a sock puppet account that signals to the target that they are under surveillance.

INVESTIGATOR TIP: With Maltego, you remain anonymous at all times, and there is no need to set up a sock puppet since Maltego acts as a proxy. This ensures your identity is protected at every stage. For high-profile investigations, you can use a stealth mode that completely restricts the desktop client from downloading data or information directly from the internet. We will explain this in the later part of this article.

Do’s and Don’ts for Every OSINT Investigator to Maintain Anonymity 🔗︎

To avoid those compromising situations, fraud and threat analysts can adopt several reliable measures. Here’s just a couple of do’s and don’ts for you:

Do This When You Run an Investigation 🔗︎

  1. Align Research Timing with the Target’s Time Zone: Conduct your investigations during the target’s local working hours (such as 9 am to 5 pm) to blend in and avoid raising suspicion.
  2. Operate on Secure Networks: Always work on secure, trusted networks. Avoid public Wi-Fi networks where your traffic can be intercepted. This is especially important in the era of remote work.
  3. Carefully Select OSINT Tools: Choose open-source intelligence tools that are known for their reliability and security to reduce the risk of exposing your digital footprint.
  4. Use a Paid VPN for Web Research: Employ a reputable Virtual Private Network (VPN) to mask your IP address, especially when researching websites. This step is crucial to prevent website owners, including potential targets, from tracking your visit back to you.

Don’t Do This When You Run an Investigation 🔗︎

  1. Ignore Time Zone Differences: Avoid conducting research at times that would seem unusual or suspicious in the target’s local time zone.
  2. Mix Personal and Work Devices: Keep your personal devices separate from the ones you use for investigations.
  3. Use Unverified OSINT Tools: Steer clear of tools without a strong reputation for security, as this can lead to data leaks or digital footprint exposure.
  4. Rely on Free VPNs or Skip VPN Usage: If possible, don’t ever run an investigation without a VPN as this can leave your IP address exposed to website owners and potential targets, especially during website investigations. Ideally, you should also avoid free VPNs as they are easier to spot and might alert your target that someone trying to obscure their location is investigating them.

These tips are just a few key examples of how you can maintain your anonymity during an investigation. We have prepared a separate 4-page-long cheat sheet with do’s and don’ts for you, which is tailored to every investigator. Make sure to download your free copy and share it with your team!

Conduct Investigations Securely with Maltego 🔗︎

In your quest to maintain full anonymity, you may choose to restrict your investigation to a single platform that can support you in avoiding the common exposure scenarios we described earlier. With Maltego, you can address the need for anonymity through several essential features.

Secure Environment for OSINT Investigations 🔗︎

Maltego allows investigators to probe social media profiles and online content without creating sock puppet accounts or risking exposure through personal accounts. It does this by querying platforms and aggregating the data in a secure sandbox environment.

This setup enables investigators to analyze content, such as translating posts or extracting images, without directly opening someone’s profile and webpages on a browser.

Transform Queries and Data Privacy 🔗︎

While investigating with Maltego, you will retrieve results from a given start or pivot point using the so-called Transforms to discover new connections that will help you carry out the next step in your investigation.

As you deal with sensitive cases and use internal data, the tool does not store details of the user’s Transform queries, ensuring that the investigator’s identifiable information remains concealed during data mining from public OSINT sources or online intelligence databases.

Privacy Modes 🔗︎

If you wish to take even more precautions, you can go one step further and switch between the two privacy modes in Maltego:

  • Normal Mode: In this mode, the Maltego Desktop Client can fetch certain data types directly from the internet. While generally safe, this method might expose the user’s IP address in the target’s traffic log, which could be a concern when investigating sensitive targets.
  • Stealth Mode: This mode ensures a higher level of confidentiality by preventing the desktop client from directly downloading data from the internet. This restriction includes blocking the fetching of website images or overlays. It’s recommended for situations requiring strict confidentiality or when there is concern about IP exposure. However, even in stealth mode, Transforms might contact the target via the public CTAS server or the user’s computer.

Download Your Cheat Sheet 🔗︎

There can still be situations where you might need to use a browser. This is why we recommend using Maltego in combination with other best practices, as outlined in the cheat sheet we prepared for you. If you haven’t already, you can download it now.

Download the resource

DE +49
Albania +355
Algeria +213
Andorra +376
Angola +244
Anguilla +1264
Antigua And Barbuda +1268
Argentina +54
Armenia +374
Aruba +297
Australia +61
Austria +43
Azerbaijan +994
Bahamas +1242
Bahrain +973
Bangladesh +880
Barbados +1246
Belarus +375
Belgium +32
Belize +501
Benin +229
Bermuda +1441
Bhutan +975
Bolivia +591
Bosnia and Herzegovina +387
Botswana +267
Brazil +55
Brunei Darussalam +673
Bulgaria +359
Burkina Faso +226
Burundi +257
Cambodia +855
Cameroon +237
Canada +1
Cape Verde +238
Cayman Islands +1345
Central African Republic +236
Chile +56
China +86
Cote d'Ivoire +225
Colombia +57
Comoros +269
Congo +242
Cook Islands +682
Costa Rica +506
Croatia +385
Cuba +53
Cyprus +90392
Czech Republic +42
Denmark +45
Djibouti +253
Dominica +1809
Dominican Republic +1809
Ecuador +593
Egypt +20
El Salvador +503
Equatorial Guinea +240
Eritrea +291
Estonia +372
Ethiopia +251
Falkland Islands (Malvinas) +500
Faroe Islands +298
Fiji +679
Finland +358
France +33
French Guiana +594
French Polynesia +689
Gabon +241
Gambia +220
Georgia +7880
Germany +49
Ghana +233
Gibraltar +350
Greece +30
Greenland +299
Grenada +1473
Guadeloupe +590
Guam +671
Guatemala +502
Guinea +224
Guinea-Bissau +245
Guyana +592
Haiti +509
Honduras +504
Hong Kong +852
Hungary +36
Iceland +354
India +91
Indonesia +62
Iran, Islamic Republic of +98
Iraq +964
Ireland +353
Israel +972
Italy +39
Jamaica +1876
Japan +81
Jordan +962
Kazakhstan +7
Kenya +254
Kiribati +686
Korea, Democratic People's Republic of +850
Korea, Republic of +82
Kuwait +965
Kyrgyzstan +996
Lao People's Democratic Republic +856
Latvia +371
Lebanon +961
Lesotho +266
Liberia +231
Libyan Arab Jamahiriya +218
Liechtenstein +417
Lithuania +370
Luxembourg +352
Macao +853
Macedonia, the former Yugoslav Republic of +389
Madagascar +261
Malawi +265
Malaysia +60
Maldives +960
Mali +223
Malta +356
Marshall Islands +692
Martinique +596
Mauritania +222
Mauritius +230
Mayotte +269
Mexico +52
Micronesia, Federated States of +691
Moldova, Republic of +373
Monaco +377
Mongolia +976
Montserrat +1664
Morocco +212
Mozambique +258
Myanmar +95
Namibia +264
Nauru +674
Nepal +977
Netherlands +31
New Caledonia +687
New Zealand +64
Nicaragua +505
Niger +227
Nigeria +234
Niue +683
Norfolk Island +672
Northern Mariana Islands +670
Norway +47
Oman +968
Pakistan +92
Palau +680
Panama +507
Papua New Guinea +675
Paraguay +595
Peru +51
Philippines +63
Poland +48
Portugal +351
Puerto Rico +1787
Qatar +974
Reunion +262
Romania +40
Russian Federation +7
Rwanda +250
San Marino +378
Sao Tome and Principe +239
Saudi Arabia +966
Senegal +221
Serbia +381
Seychelles +248
Sierra Leone +232
Singapore +65
Slovakia +421
Slovenia +386
Solomon Islands +677
Somalia +252
South Africa +27
Spain +34
Sri Lanka +94
Saint Helena +290
Saint Kitts and Nevis +1869
Saint Lucia +1758
Sudan +249
Suriname +597
Swaziland +268
Sweden +46
Switzerland +41
Syrian Arab Republic +963
Taiwan +886
Tajikistan +7
Thailand +66
Togo +228
Tonga +676
Trinidad and Tobago +1868
Tunisia +216
Turkey +90
Turkmenistan +993
Turks and Caicos Islands +1649
Tuvalu +688
Uganda +256
United Kingdom +44
Ukraine +380
United Arab Emirates +971
Uruguay +598
United States +1
Uzbekistan +7
Vanuatu +678
Holy See (Vatican City State) +379
Venezuela +58
Viet Nam +84
Virgin Islands, British +84
Virgin Islands, U.S. +84
Wallis and Futuna +681
Yemen +967
Zambia +260
Zimbabwe +263

By clicking on "Access", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.

Step-by-step Investigations with Maltego 🔗︎

Now that you understand how Maltego can help you remain anonymous during an investigation, your next step should be to explore hands-on how Maltego can assist in your daily work. To do that, check out this step-by-step guide on automating your brand protection using Maltego Machines to speed up repetitive steps in your investigation conducted in Maltego.

If you are also interested in seeing how Maltego can be practically used to track down individuals responsible for online counterfeit sales, don’t miss the opportunity to watch this webinar demo recording.

Don’t forget to follow us on Twitter, LinkedIn, and Mastodon, and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

By clicking on "Subscribe", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.