Overview
Maltego's Paterva CTAS Transforms are provided to Maltego users as part of the Maltego Standard Transforms which any Maltego Desktop Client has access to. The Maltego Standard Transforms support a vast variety of investigative tasks, including network footprinting, social media investigations, digital forensics, enriching threat intelligence, analyzing web content and more. They can be used on their own to conduct investigations, or supplement other specialized integrations available in the Transform Hub.
For more information about Maltego Standard Transforms click here
To Location [From Bio]
Description
Extract the location from a Twitter affiliations bio.
| Display Name | To Location [From Bio] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | From Bio |
| Transform Name | AffTwitterToLocation |
| Input Entities | maltego.affiliation.Twitter |
| Output Entities | maltego.Location |
| Short Description | Extract the location from a Twitter affiliations bio. |
To Person [Convert]
Description
This transform will convert the Affiliation to a person, with the alias in the ‘additional’ field
| Display Name | To Person [Convert] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Convert |
| Transform Name | AffTwitterToPerson |
| Input Entities | maltego.affiliation.Twitter |
| Output Entities | maltego.Person |
| Short Description | This transform will convert the Affiliation to a person, with the alias in the ‘additional’ field |
To Company [Owner]
Description
This transform will try to determine the owner of the AS
| Display Name | To Company [Owner] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Owner |
| Transform Name | ASNumberToCompany |
| Input Entities | maltego.AS |
| Output Entities | maltego.Phrase |
| Short Description | This transform will try to determine the owner of the AS |
To Netblocks in this AS [RobTex]
Description
This transform shows which routes are located within an AS number by looking it up on RobTex (www.robtex.com)
| Robtex HTTP timeout (ms) | int | 25000 | True | False | False |
| Display Name | To Netblocks in this AS [RobTex] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | RobTex |
| Transform Name | ASNumberToNetblocks_Robtex |
| Input Entities | maltego.AS |
| Output Entities | maltego.Netblock |
| Short Description | This transform shows which routes are located within an AS number by looking it up on RobTex (www.robtex.com) |
To Phrase [Change Entity Type]
Description
Converts an Alias to a phrase entity.
| Display Name | To Phrase [Change Entity Type] |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | Change Entity Type |
| Transform Name | convertToPhrase |
| Input Entities | maltego.Alias |
| Output Entities | maltego.Phrase |
| Short Description | Converts an Alias to a phrase entity. |
To Domains [DNS]
| Display Name | To Domains [DNS] |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | DNS |
| Output Entities | maltego.Domain |
Variants
| DNSNameToDomain_DNS | maltego.DNSName | This transform extracts all the domains from a DNS Name - it excludes TLDs and SLD. |
| DomainToDomain_Sub | maltego.Domain | This transform extracts all the domains from a domain name - it excludes TLDs and SLD. |
To IP Address [DNS]
Description
This transform resolves a DNS name to an IP address using plain old DNS
| Display Name | To IP Address [DNS] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | DNS |
| Transform Name | DNSNameToIPAddress_DNS |
| Input Entities | maltego.DNSName |
| Output Entities | maltego.IPv4Address |
| Short Description | This transform resolves a DNS name to an IP address using plain old DNS |
To Web site [Query ports]
Description
This transform detemines if a DNS Name is a Web Site by checking for responsive HTTP(s) ports.
| HTTP Query Ports | string | [‘80’] | True | False | False |
| HTTP timeout (ms) | int | 8000 | True | False | False |
| HTTPS Query Ports | string | [‘443’] | True | False | False |
| Display Name | To Web site [Query ports] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Query ports |
| Transform Name | DNSNameToWebsite_QueryPorts |
| Input Entities | maltego.DNSName |
| Output Entities | maltego.Website |
| Short Description | This transform detemines if a DNS Name is a Web Site by checking for responsive HTTP(s) ports. |
To Entities [IBM Watson]
| Companies To Ignore | string | [‘icann’, ‘google’, ‘microsoft’, ‘ibm’, ‘facebook’, ‘twitter’, ‘adobe’, ‘creative commons’, ‘hp’, ‘yahoo’, ‘amazon’, ‘youtube’, ‘apple’, ‘ebay’, ‘paypal’] | True | False | False |
| Display Name | To Entities [IBM Watson] |
| Owner | Paterva |
| Author | PR |
| Data Source | IBM Watson |
Variants
| DocumentToEntities | maltego.Document | maltego.Person,maltego.EmailAddress,maltego.Phrase,maltego.Document | This transform extracts named entities (person, company etc) from the document. |
| toEntitiesNERTwitter | maltego.Twit | maltego.Phrase | Extracts named entities using IBM Watson. |
| URLToPerson_NLP | maltego.URL | maltego.Phrase | This transform uses Natural Language Processing (NLP/NER) to extract entities |
Description
This transform extracts the meta information from the document and then parses it for username (persons) and/or email addresses.
| Display Name | Parse meta information |
| Owner | Paterva |
| Author | Paterva |
| Data Source | |
| Transform Name | DocumentToPersonEmail_Meta |
| Input Entities | maltego.Document |
| Output Entities | maltego.Person,maltego.EmailAddress,maltego.Phrase,maltego.Document |
| Short Description | This transform extracts the meta information from the document and then parses it for username (persons) and/or email addresses. |
To URL [Show SE results]
Description
This transform just dumps the URL of the Document for further use.
| Display Name | To URL [Show SE results] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Show SE results |
| Transform Name | DocumentToURL_Dump |
| Input Entities | maltego.Document |
| Output Entities | maltego.URL |
| Short Description | This transform just dumps the URL of the Document for further use. |
To DNS Name [Robtex]
Description
This transform will search for any DNS names in the domain using Robtex database.
| Extra search terms | string | * | True | False | False |
| Robtex HTTP timeout (ms) | int | 25000 | True | False | False |
| Display Name | To DNS Name [Robtex] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Robtex |
| Transform Name | DomainToDNSName_DB |
| Input Entities | maltego.Domain |
| Output Entities | maltego.DNSName |
| Short Description | This transform will search for any DNS names in the domain using Robtex database. |
To DNS Name (interesting) [Robtex]
Description
This transform will search for any DNS names in the domain using Robtex database.
| Extra search terms | string | vpn,webmail,firewall,test,scada,intranet,secure,ssh,database | True | False | False |
| Robtex HTTP timeout (ms) | int | 25000 | True | False | False |
| Display Name | To DNS Name (interesting) [Robtex] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Robtex |
| Transform Name | DomainToDNSName_DB_interest |
| Input Entities | maltego.Domain |
| Output Entities | maltego.DNSName |
| Short Description | This transform will search for any DNS names in the domain using Robtex database. |
To DNS Name [Find common DNS names]
Description
This transform will try to discover various common DNS Names in a domain.
| DNS Names to test | string | mail,mx,ns,ftp,webmail,web,gateway,secure,intranet,extranet,smtp,pop,ns1,mx1,email,admin,dmz,blog,dns,forum,ntp,pub,route,sql,ssh,webaccess,xml,imap, | True | False | False |
| Display Name | To DNS Name [Find common DNS names] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Find common DNS names |
| Transform Name | DomainToDNSName_DNSBrute |
| Input Entities | maltego.Domain |
| Output Entities | maltego.DNSName |
| Short Description | This transform will try to discover various common DNS Names in a domain. |
To DNS Name [Using Name Schema dictionary]
Description
This transform will try test various name schema’s against a domain.
| Test depth for Name Schema Files | int | 4 | True | False | False |
| Display Name | To DNS Name [Using Name Schema dictionary] |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | Using Name Schema dictionary |
| Transform Name | DomainToDNSNameSchema |
| Input Entities | maltego.Domain |
| Output Entities | maltego.DNSName |
| Short Description | This transform will try test various name schema’s against a domain. |
To DNS Name [Attempt zone transfer]
Description
This transform will attempt to perform a zone transfer a returns A and Cname records
| Timeout (seconds) | int | 8 | True | False | False |
| Display Name | To DNS Name [Attempt zone transfer] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Attempt zone transfer |
| Transform Name | DomainToDNSName_ZT |
| Input Entities | maltego.Domain |
| Output Entities | maltego.DNSName |
| Short Description | This transform will attempt to perform a zone transfer a returns A and Cname records |
To Files (Interesting) [using Search Engine]
| HTTP timeout (ms) | int | 8000 | True | False | False |
| Search Extension [extension:priority] | string | [‘sql:100’, ‘zip:90’, ‘csv:90’, ‘tgz:90’, ‘bak:90’, ‘old:90’, ‘wav:20’, ‘mp3:20’, ‘exe:20’, ‘txt:20’] | True | False | False |
| Display Name | To Files (Interesting) [using Search Engine] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | using Search Engine |
| Output Entities | maltego.Document |
Variants
| DomainToDocumentOther_SE | maltego.Domain | Search for interesting files hosted on this domain. |
| PhraseToDocumentOthers_SE | maltego.Phrase | This transform will search for the given phrase and show interesting files contaning the term. |
To Files (Office) [using Search Engine]
| HTTP timeout (ms) | int | 8000 | True | False | False |
| Search Extension [extension:priority] | string | [‘xls:100’, ‘xlsx:100’, ‘csv:100’, ‘doc:70’, ‘docx:70’, ‘ppt:40’, ‘pptx:40’, ‘mdb:40’, ‘pdf:40’] | True | False | False |
| Display Name | To Files (Office) [using Search Engine] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | using Search Engine |
| Output Entities | maltego.Document |
Variants
| DomainToDocument_SE | maltego.Domain | Search for office documents hosted on this domain. |
| PhraseToDocument_SE | maltego.Phrase | This transform will search for the given phrase and show documents (Office[tm]) containing the term. |
To Domain [Find other TLDs]
Description
This transform will try to find domains with different TLDs.
| Robtex HTTP timeout (ms) | int | 25000 | True | False | False |
| Display Name | To Domain [Find other TLDs] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Find other TLDs |
| Transform Name | DomainToDomain_TLD |
| Input Entities | maltego.Domain |
| Output Entities | maltego.Domain |
| Short Description | This transform will try to find domains with different TLDs. |
To Emails @domain [using Search Engine]
Description
Search for emails containing the domain.
| HTTP timeout (ms) | int | 8000 | True | False | False |
| Display Name | To Emails @domain [using Search Engine] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | using Search Engine |
| Transform Name | DomainToEmailAddress_AtDomain_SE |
| Input Entities | maltego.Domain |
| Output Entities | maltego.EmailAddress |
| Short Description | Search for emails containing the domain. |
To Email addresses [using Search Engine]
Description
Search for related emails.
| HTTP timeout (ms) | int | 8000 | True | False | False |
| Display Name | To Email addresses [using Search Engine] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | using Search Engine |
| Transform Name | DomainToEmailAddress_SE |
| Input Entities | maltego.Domain |
| Output Entities | maltego.EmailAddress |
| Short Description | Search for related emails. |
To Email address [From whois info]
Description
This transform obtains whois information of the IP number, then parses it for email addresses.
| Display Name | To Email address [From whois info] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | From whois info |
| Output Entities | maltego.EmailAddress |
| Short Description | This transform obtains whois information of the IP number, then parses it for email addresses. |
Variants
| DomainToEmailAddress_Whois | maltego.Domain |
| IPAddressToEmailAddress_Whois | maltego.IPv4Address |
To Entities from WHOIS [IBM Watson]
Description
This transform obtains whois information of the domain then parses it for entities using NER
| Companies To Ignore | string | [‘icann’, ‘google’, ‘microsoft’, ‘ibm’, ‘facebook’, ‘twitter’, ‘adobe’, ‘creative commons’, ‘hp’, ‘yahoo’, ‘amazon’, ‘youtube’, ‘apple’, ‘ebay’, ‘paypal’] | True | False | False |
| Display Name | To Entities from WHOIS [IBM Watson] |
| Owner | John Doe |
| Author | John Doe |
| Data Source | IBM Watson |
| Transform Name | DomainToEntities_Whois_NER |
| Input Entities | maltego.Domain |
| Output Entities | maltego.Phrase |
| Short Description | This transform obtains whois information of the domain then parses it for entities using NER |
To DNS Name - MX (mail server)
Description
This transform will find the MX records (mail servers) of a domain.
| Display Name | To DNS Name - MX (mail server) |
| Owner | Paterva |
| Author | Paterva |
| Data Source | |
| Transform Name | DomainToMXrecord_DNS |
| Input Entities | maltego.Domain |
| Output Entities | maltego.MXRecord |
| Short Description | This transform will find the MX records (mail servers) of a domain. |
To DNS Name - NS (name server)
Description
This transform will find the NS records (name servers) of a domain.
| Display Name | To DNS Name - NS (name server) |
| Owner | Paterva |
| Author | Paterva |
| Data Source | |
| Transform Name | DomainToNSrecord_DNS |
| Input Entities | maltego.Domain |
| Output Entities | maltego.NSRecord |
| Short Description | This transform will find the NS records (name servers) of a domain. |
To Phone Numbers [using Search Engine]
Description
Search for related phone numbers.
| HTTP timeout (ms) | int | 8000 | True | False | False |
| Display Name | To Phone Numbers [using Search Engine] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | using Search Engine |
| Transform Name | DomainToPhoneNumber_SE |
| Input Entities | maltego.Domain |
| Output Entities | maltego.PhoneNumber |
| Short Description | Search for related phone numbers. |
To Phone numbers [From whois info]
Description
This transforms obtains whois information of the given domain, then parses it for telephone numbers.
| Display Name | To Phone numbers [From whois info] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | From whois info |
| Transform Name | DomainToPhone_Whois |
| Input Entities | maltego.Domain |
| Output Entities | maltego.PhoneNumber |
| Short Description | This transforms obtains whois information of the given domain, then parses it for telephone numbers. |
To DNS Name - SOA (Start of Authority)
Description
Extracts information for this domain from the SOA record.
| Display Name | To DNS Name - SOA (Start of Authority) |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | |
| Transform Name | DomainToSOAInformation |
| Input Entities | maltego.Domain |
| Output Entities | maltego.NSRecord, maltego.EmailAddress |
| Short Description | Extracts information for this domain from the SOA record. |
To DNS Name - SPF (sender policy framework)
Description
Extracts information for this domain from the SPF (txt) record.
| Display Name | To DNS Name - SPF (sender policy framework) |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | |
| Transform Name | DomainToSPFInformation |
| Input Entities | maltego.Domain |
| Output Entities | maltego.Netblock, maltego.IPv4Address, maltego.DNSName, maltego.MXRecord, maltego.DNSName, maltego.Domain |
| Short Description | Extracts information for this domain from the SPF (txt) record. |
To Website [Quick lookup]
Description
This transform will check to see if there is a www.DOMAIN entry. Useful when used in bulk.
| Display Name | To Website [Quick lookup] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Quick lookup |
| Transform Name | DomainToWebsite_DNS |
| Input Entities | maltego.Domain |
| Output Entities | maltego.Website |
| Short Description | This transform will check to see if there is a www.DOMAIN entry. Useful when used in bulk. |
To Website using domain [Bing]
Description
Search for websites that contain the domain.
| HTTP timeout (ms) | int | 8000 | True | False | False |
| Display Name | To Website using domain [Bing] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Bing |
| Transform Name | DomainToWebsiteDNS_SE |
| Input Entities | maltego.Domain |
| Output Entities | maltego.Website |
| Short Description | Search for websites that contain the domain. |
To Website mentioning domain [Bing]
Description
Search for websites mentioning the domain in their content.
| HTTP timeout (ms) | int | 8000 | True | False | False |
| Display Name | To Website mentioning domain [Bing] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Bing |
| Transform Name | DomainToWebsite_SE |
| Input Entities | maltego.Domain |
| Output Entities | maltego.Website |
| Short Description | Search for websites mentioning the domain in their content. |
To Website [using Search Engine]
| HTTP timeout (ms) | int | 8000 | True | False | False |
| Display Name | To Website [using Search Engine] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | using Search Engine |
| Output Entities | maltego.Website |
Variants
| EmailAddressToDNSName_SE | maltego.EmailAddress | Search for websites that mention the email. |
| PhoneNumberToWebsite_SE | maltego.PhoneNumber | This transform searches for the telephone number and returns related sites. |
| PhraseToWebsite_SE | maltego.Phrase | This transform will search for the given phrase and show the sites where the phrase occurs. |
To Domain [DNS]
Description
This transform will remove the part in front of the @ sign of the given address.
| Display Name | To Domain [DNS] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | DNS |
| Transform Name | EmailAddressToDomain_DNS |
| Input Entities | maltego.EmailAddress |
| Output Entities | maltego.Domain |
| Short Description | This transform will remove the part in front of the @ sign of the given address. |
To Email Addresses [using Search Engine]
| HTTP timeout (ms) | int | 8000 | True | False | False |
| Display Name | To Email Addresses [using Search Engine] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | using Search Engine |
| Output Entities | maltego.EmailAddress |
Variants
| EmailAddressToEmailAddress_SE | maltego.EmailAddress | This transform will search for the email address and show related email addresses. |
| PhraseToEmailAddress_SE | maltego.Phrase | This transform will search for the phrase and show related email addresses. |
Verify email address exists [SMTP]
Description
This transform simply connects to the relevant mail server and checks to see if the email address exists. The results are passed back in the same entity - as a label.
| Display Name | Verify email address exists [SMTP] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | SMTP |
| Transform Name | EmailAddressToEmailAddress_Verify |
| Input Entities | maltego.EmailAddress |
| Output Entities | maltego.EmailAddress |
| Short Description | This transform simply connects to the relevant mail server and checks to see if the email address exists. The results are passed back in the same entity - as a label. |
To Person [Parse separator]
Description
This transform tries to figure out if it can parse the email address to a person’s name using separators
| Format (FL-firstnamelastname,LF-lastnamefirstname) | string | FL | True | True | False |
| Display Name | To Person [Parse separator] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Parse separator |
| Transform Name | EmailAddressToPerson_Parse |
| Input Entities | maltego.EmailAddress |
| Output Entities | maltego.Person |
| Short Description | This transform tries to figure out if it can parse the email address to a person’s name using separators |
To Phone number [using Search Engine]
Description
This transform will search for the given email address and show the related telephone numbers.
| HTTP timeout (ms) | int | 8000 | True | False | False |
| Display Name | To Phone number [using Search Engine] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | using Search Engine |
| Transform Name | EmailAddressToPhoneNumber_SE |
| Input Entities | maltego.EmailAddress |
| Output Entities | maltego.PhoneNumber |
| Short Description | This transform will search for the given email address and show the related telephone numbers. |
To URLs [Show Search Engine results]
Description
This transform just dumps the URLs collected from the search engine.
| Display Name | To URLs [Show Search Engine results] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Show Search Engine results |
| Output Entities | maltego.URL |
| Short Description | This transform just dumps the URLs collected from the search engine. |
Variants
| EmailAddressToURL_Expand | maltego.EmailAddress |
| PhoneNumberToURL_Expand | maltego.PhoneNumber |
To Flickr Account
Description
Looks up an email address on flickr and returns account details.
| Display Name | To Flickr Account |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | |
| Transform Name | emailToFlickrAccount |
| Input Entities | maltego.EmailAddress |
| Output Entities | maltego.affiliation.Flickr |
| Short Description | Looks up an email address on flickr and returns account details. |
To Myspace Account
Description
Looks up an email address on myspace and returns account details.
| Display Name | To Myspace Account |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | |
| Transform Name | emailToMyspaceAccount |
| Input Entities | maltego.EmailAddress |
| Output Entities | maltego.affiliation.Myspace, maltego.Alias |
| Short Description | Looks up an email address on myspace and returns account details. |
To DNS Name [Enumerate hostname numerically]
Description
Enumerates hostnames numerically. E.g. mail1.paterva.com would try mail2., mail3.
| Auto Padding | boolean | True | True | True | False |
| Padding | int | 0 | True | True | False |
| Range End | int | 9 | True | True | False |
| Range Start | int | 1 | True | True | False |
| Display Name | To DNS Name [Enumerate hostname numerically] |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | Enumerate hostname numerically |
| Transform Name | enumerateHostNamesNumerically |
| Input Entities | maltego.DNSName |
| Output Entities | maltego.DNSName |
| Short Description | Enumerates hostnames numerically. E.g. mail1.paterva.com would try mail2., mail3. |
To Friends [Get Flickr Friends]
Description
Enumerate friends of a specific flickr user.
| Display Name | To Friends [Get Flickr Friends] |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | Get Flickr Friends |
| Transform Name | FlickrAccountGetFriends |
| Input Entities | maltego.affiliation.Flickr |
| Output Entities | maltego.affiliation.Flickr |
| Short Description | Enumerate friends of a specific flickr user. |
To Website using IP: [Bing]
Description
Search for websites that have been hosted on this IP.
| HTTP timeout (ms) | int | 8000 | True | False | False |
| Display Name | To Website using IP: [Bing] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Bing |
| Transform Name | IPAddressToDNSNameBing_SE |
| Input Entities | maltego.IPv4Address |
| Output Entities | maltego.Website |
| Short Description | Search for websites that have been hosted on this IP. |
To DNS Name [Reverse DNS]
Description
This transform reverse resolves an IP address to a DNS name using plain old DNS
| Display Name | To DNS Name [Reverse DNS] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Reverse DNS |
| Transform Name | IPAddressToDNSName_DNS |
| Input Entities | maltego.IPv4Address |
| Output Entities | maltego.DNSName |
| Short Description | This transform reverse resolves an IP address to a DNS name using plain old DNS |
To DNS Name from passive DNS [Robtex]
Description
This transform performs a reverse lookup via historical/passive DNS.
| Display Name | To DNS Name from passive DNS [Robtex] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Robtex |
| Transform Name | IPAddressToDNSName_SharedIP |
| Input Entities | maltego.IPv4Address |
| Output Entities | maltego.DNSName |
| Short Description | This transform performs a reverse lookup via historical/passive DNS. |
To Domain [Sharing this MX]
Description
This transform returns shared domains on a MX record using historical/passive DNS
| Robtex HTTP timeout (ms) | int | 25000 | True | False | False |
| Display Name | To Domain [Sharing this MX] |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | Sharing this MX |
| Transform Name | IPAddressToDomain_SharedMX |
| Input Entities | maltego.IPv4Address |
| Output Entities | maltego.Domain |
| Short Description | This transform returns shared domains on a MX record using historical/passive DNS |
To Domain [Sharing this NS]
Description
This transform returns shared domains on a NS record using historical/passive DNS
| Robtex HTTP timeout (ms) | int | 25000 | True | False | False |
| Display Name | To Domain [Sharing this NS] |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | Sharing this NS |
| Transform Name | IPAddressToDomain_SharedNS |
| Input Entities | maltego.IPv4Address |
| Output Entities | maltego.Domain,maltego.Netblock |
| Short Description | This transform returns shared domains on a NS record using historical/passive DNS |
To Entities From WHOIS [IBM Watson]
| Companies To Ignore | string | [‘icann’, ‘google’, ‘microsoft’, ‘ibm’, ‘facebook’, ‘twitter’, ‘adobe’, ‘creative commons’, ‘hp’, ‘yahoo’, ‘amazon’, ‘youtube’, ‘apple’, ‘ebay’, ‘paypal’] | True | False | False |
| Display Name | To Entities From WHOIS [IBM Watson] |
| Owner | |
| Author | |
| Data Source | IBM Watson |
| Output Entities | maltego.Phrase |
Variants
| IPAddressToEntities_Whois_NER | maltego.IPv4Address | This transform obtains whois information of IP number, then parses it for entities using NER |
| NetblockToEntities_NER_Whois | maltego.Netblock | This transform obtains whois information of netblock (well the first IP in the block), then parses it for entities using NER |
To Netblock [Using natural boundaries]
Description
This transform will carve a netblock from an IP - counting a certain number of IPs up and down.
| Block Size | int | 256 | True | False | False |
| Display Name | To Netblock [Using natural boundaries] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Using natural boundaries |
| Transform Name | IPAddressToNetblock_Cuts |
| Input Entities | maltego.IPv4Address |
| Output Entities | maltego.Netblock |
| Short Description | This transform will carve a netblock from an IP - counting a certain number of IPs up and down. |
To Netblock [Blocks delegated to this IP as NS]
Description
This transform will contact Robtex and determine if the IP number has any reverse DNS netblocks has been delegated to it.
| Robtex HTTP timeout (ms) | int | 25000 | True | False | False |
| Display Name | To Netblock [Blocks delegated to this IP as NS] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Blocks delegated to this IP as NS |
| Transform Name | IPAddressToNetblock_NS4block |
| Input Entities | maltego.IPv4Address |
| Output Entities | maltego.Netblock |
| Short Description | This transform will contact Robtex and determine if the IP number has any reverse DNS netblocks has been delegated to it. |
To Netblock [Using routing info]
Description
This transform determines the network block that an IP address belong to by looking at routing info
| Robtex HTTP timeout (ms) | int | 25000 | True | False | False |
| Display Name | To Netblock [Using routing info] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Using routing info |
| Transform Name | IPAddressToNetblock_SS |
| Input Entities | maltego.IPv4Address |
| Output Entities | maltego.Netblock |
| Short Description | This transform determines the network block that an IP address belong to by looking at routing info |
To Netblock [Using whois info]
Description
This transform will get the netblock via the whois service (ARIN/APNIC/LACNIC/AFRINIC/RIPE)
| Display Name | To Netblock [Using whois info] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Using whois info |
| Transform Name | IPAddressToNetblock_whois |
| Input Entities | maltego.IPv4Address |
| Output Entities | maltego.Netblock |
| Short Description | This transform will get the netblock via the whois service (ARIN/APNIC/LACNIC/AFRINIC/RIPE) |
To Phone number [From whois info]
Description
Transforms obtains whois information of IP number, then parses it for telephone numbers
| Display Name | To Phone number [From whois info] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | From whois info |
| Transform Name | IPAddressToPhone_Whois |
| Input Entities | maltego.IPv4Address |
| Output Entities | maltego.PhoneNumber |
| Short Description | Transforms obtains whois information of IP number, then parses it for telephone numbers |
To Website mentioning IP [Bing]
Description
Find websites containing the IP.
| HTTP timeout (ms) | int | 8000 | True | False | False |
| Display Name | To Website mentioning IP [Bing] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Bing |
| Transform Name | IPAddressToWebsite_SE |
| Input Entities | maltego.IPv4Address |
| Output Entities | maltego.Website |
| Short Description | Find websites containing the IP. |
To Domains [Sharing this MX]
Description
This transform determines which other domains share this MX record by looking at historical/passive DNS.
| Robtex HTTP timeout (ms) | int | 25000 | True | False | False |
| Display Name | To Domains [Sharing this MX] |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | Sharing this MX |
| Transform Name | MXrecordToDomain_SharedMX |
| Input Entities | maltego.MXRecord |
| Output Entities | maltego.Domain |
| Short Description | This transform determines which other domains share this MX record by looking at historical/passive DNS. |
To Social Account [Using NameChk]
Description
This transform will query NameChk.com for social accounts with the given alias.
| Namecheck API Key | string | | True | False | False |
| Display Name | To Social Account [Using NameChk] |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | Using NameChk |
| Transform Name | namechk |
| Input Entities | maltego.Alias |
| Output Entities | maltego.Alias |
| Short Description | This transform will query NameChk.com for social accounts with the given alias. |
To AS number
Description
This transforms determines the AS number of the netblock.
| Robtex HTTP timeout (ms) | int | 25000 | True | False | False |
| Display Name | To AS number |
| Owner | Paterva |
| Author | Paterva |
| Data Source | |
| Transform Name | NetblockToAS_SS |
| Input Entities | maltego.Netblock |
| Output Entities | maltego.AS |
| Short Description | This transforms determines the AS number of the netblock. |
To DNS Names in netblock [Reverse DNS]
Description
This transform contacts Robtex (www.robtex.com) and asks it for any DNS Names that resolves to IP within this netblock.
| Robtex HTTP timeout (ms) | int | 25000 | True | False | False |
| Display Name | To DNS Names in netblock [Reverse DNS] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Reverse DNS |
| Transform Name | NetblockToDNSName_SS |
| Input Entities | maltego.Netblock |
| Output Entities | maltego.DNSName |
| Short Description | This transform contacts Robtex (www.robtex.com) and asks it for any DNS Names that resolves to IP within this netblock. |
To IP addresses [Found in Netblock]
Description
Converts Netblock to IPs within that netblock.
| Display Name | To IP addresses [Found in Netblock] |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | Found in Netblock |
| Transform Name | NetblockToIPs |
| Input Entities | maltego.Netblock |
| Output Entities | maltego.IPv4Address |
| Short Description | Converts Netblock to IPs within that netblock. |
To Netblocks [Cuts Netblock into smaller ones]
Description
Converts Netblock to smaller Netblocks.
| Netblock size | string | | True | True | False |
| Display Name | To Netblocks [Cuts Netblock into smaller ones] |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | Cuts Netblock into smaller ones |
| Transform Name | NetblockToNetblocks |
| Input Entities | maltego.Netblock |
| Output Entities | maltego.Netblock |
| Short Description | Converts Netblock to smaller Netblocks. |
To Domains [Sharing this NS]
Description
This transform determines which other domains share this NS record by looking at historical/passive DNS.
| Robtex HTTP timeout (ms) | int | 25000 | True | False | False |
| Display Name | To Domains [Sharing this NS] |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | Sharing this NS |
| Transform Name | NSrecordToDomain_SharedNS |
| Input Entities | maltego.NSRecord |
| Output Entities | maltego.Domain |
| Short Description | This transform determines which other domains share this NS record by looking at historical/passive DNS. |
To Netblock [Blocks delegated to this NS]
Description
This transform will contact Robtex and determine if the NS record has any (reverse) DNS netblocks delegated to it.
| Robtex HTTP timeout (ms) | int | 25000 | True | False | False |
| Display Name | To Netblock [Blocks delegated to this NS] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Blocks delegated to this NS |
| Transform Name | NSrecordToNetblock_NS4block |
| Input Entities | maltego.NSRecord |
| Output Entities | maltego.Netblock |
| Short Description | This transform will contact Robtex and determine if the NS record has any (reverse) DNS netblocks delegated to it. |
To Email Address [Verify common]
Description
This transform will test common free mail providers for combinations of the person’s name. The transform only works with mail servers that report failed recipients with a 550 code and verified recipients with a 250 code. Not all mail servers do this, for example Yahoo does not! Also note that this transform makes a TCP connection to the given entity’s MX record!
| Domains to check | string | gmail.com,hotmail.com | True | False | False |
| Display Name | To Email Address [Verify common] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Verify common |
| Transform Name | PersonToEmailAddress_Common |
| Input Entities | maltego.Person |
| Output Entities | maltego.EmailAddress |
| Short Description | This transform will test common free mail providers for combinations of the person’s name. The transform only works with mail servers that report failed recipients with a 550 code and verified recipients with a 250 code. Not all mail servers do this, for example Yahoo does not! Also note that this transform makes a TCP connection to the given entity’s MX record! |
To EmailAddress [Bing]
Description
Search for possible email addresses.
| Additional term (space=none) | string | | True | True | False |
| Domain/TLD (space=none) | string | | True | True | False |
| HTTP timeout (ms) | int | 8000 | True | False | False |
| Display Name | To EmailAddress [Bing] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Bing |
| Transform Name | PersonToEmailAddress_SE |
| Input Entities | maltego.Person |
| Output Entities | maltego.EmailAddress |
| Short Description | Search for possible email addresses. |
To PhoneNumber [Bing]
Description
Search for possible phone numbers.
| Additional term (space=none) | string | | True | True | False |
| Domain/TLD (space=none) | string | | True | True | False |
| HTTP timeout (ms) | int | 8000 | True | False | False |
| Display Name | To PhoneNumber [Bing] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Bing |
| Transform Name | PersonToPhoneNumber_SE |
| Input Entities | maltego.Person |
| Output Entities | maltego.Website |
| Short Description | Search for possible phone numbers. |
To Website [Bing]
Description
This transform shows sites where a permutation of the person’s name was found.
| Additional term (space=none) | string | | True | True | False |
| Domain/TLD (space=none) | string | | True | True | False |
| HTTP timeout (ms) | int | 8000 | True | False | False |
| Display Name | To Website [Bing] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Bing |
| Transform Name | PersonToWebsite_SE |
| Input Entities | maltego.Person |
| Output Entities | maltego.Website |
| Short Description | This transform shows sites where a permutation of the person’s name was found. |
To Email Address [using Search Engine]
Description
This transform searches for the telephone number and returns related email addresses.
| HTTP timeout (ms) | int | 8000 | True | False | False |
| Display Name | To Email Address [using Search Engine] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | using Search Engine |
| Transform Name | PhoneNumberToEmailAddress_SE |
| Input Entities | maltego.PhoneNumber |
| Output Entities | maltego.EmailAddress |
| Short Description | This transform searches for the telephone number and returns related email addresses. |
To Phone Number [using Search Engine]
Description
This transform searches for the telephone number and returns related telephone numbers.
| HTTP timeout (ms) | int | 8000 | True | False | False |
| Display Name | To Phone Number [using Search Engine] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | using Search Engine |
| Transform Name | PhoneNumberToPhoneNumber_SE |
| Input Entities | maltego.PhoneNumber |
| Output Entities | maltego.PhoneNumber |
| Short Description | This transform searches for the telephone number and returns related telephone numbers. |
To Telephone numbers [using Search Engine]
Description
This transform will search for the phrase and shows the related telephone numbers.
| Exact Match | boolean | False | True | False | False |
| HTTP timeout (ms) | int | 8000 | True | False | False |
| Display Name | To Telephone numbers [using Search Engine] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | using Search Engine |
| Transform Name | PhraseToPhoneNumber_SE |
| Input Entities | maltego.Phrase |
| Output Entities | maltego.PhoneNumber |
| Short Description | This transform will search for the phrase and shows the related telephone numbers. |
To Websites - specifics (pastebin) [using SE]
Description
This transform will search for the given phrase and show the sites where the phrase occurs.
| Exact Match | boolean | False | True | False | False |
| HTTP timeout (ms) | int | 8000 | True | False | False |
| Site List | string | [‘pastie.org’, ‘pastebin.com’, ‘pastebin.ca’] | True | True | False |
| Display Name | To Websites - specifics (pastebin) [using SE] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | using SE |
| Transform Name | PhraseToSpecificSites_SE |
| Input Entities | maltego.Phrase |
| Output Entities | maltego.Website |
| Short Description | This transform will search for the given phrase and show the sites where the phrase occurs. |
Description
The transform will extract aliases from a tweet.
| Display Name | To Aliases [mentioned in Tweet] |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | mentioned in Tweet |
| Transform Name | pullAliases |
| Input Entities | maltego.Twit |
| Output Entities | maltego.Alias |
| Short Description | The transform will extract aliases from a tweet. |
Description
Simply splits tweet into words and pulls the hashtag.
| Hashes to ignore. | string | | True | False | False |
| Display Name | To Hash Tags |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | |
| Transform Name | pullHashTags |
| Input Entities | maltego.Twit |
| Output Entities | maltego.hashtag |
| Short Description | Simply splits tweet into words and pulls the hashtag. |
To Stock Symbol
Description
Simply splits tweet into words and pulls the stock symbols.
| Stocks to ignore. | string | | True | False | False |
| Display Name | To Stock Symbol |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | |
| Transform Name | pullStockSymbol |
| Input Entities | maltego.Twit |
| Output Entities | maltego.StockSymbol |
| Short Description | Simply splits tweet into words and pulls the stock symbols. |
Description
Try return URLs from tweets.
| Expand URLs | boolean | True | True | False | False |
| Include Tweet Links | boolean | False | True | False | False |
| Display Name | To URLs [Extracts links from Tweet] |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | Extracts links from Tweet |
| Transform Name | pullURLs |
| Input Entities | maltego.Twit |
| Output Entities | maltego.URL |
| Short Description | Try return URLs from tweets. |
To Alias
| Display Name | To Alias |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | |
| Transform Name | toAliasFromTwitterAccount |
| Input Entities | maltego.affiliation.Twitter |
| Output Entities | maltego.Alias |
| Short Description | |
To Circular Area
| Radius of Area in m | int | 1000 | True | False | False |
| Display Name | To Circular Area |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | |
| Transform Name | ToArea |
| Input Entities | maltego.GPS |
| Output Entities | maltego.CircularArea |
| Short Description | |
To DNS Name [From DynDNS username]
Description
Looks up an alias against a list of dyndns domains.
| Display Name | To DNS Name [From DynDNS username] |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | From DynDNS username |
| Transform Name | toDynDNSNames |
| Input Entities | maltego.Alias |
| Output Entities | maltego.DNSName |
| Short Description | Looks up an alias against a list of dyndns domains. |
To Location [city, country]
| Country Language | string | en | True | False | False |
| Display Name | To Location [city, country] |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | city, country |
| Output Entities | maltego.Location |
Variants
| toLocation | maltego.IPv4Address | This transform takes an IP address to a location with the MaxMind free city database. |
| toLocationNetblock | maltego.Netblock | This transform takes an netblock to a location with the MaxMind free city database. |
To Location [country]
| Country Language | string | en | True | False | False |
| Display Name | To Location [country] |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | country |
| Output Entities | maltego.Location |
Variants
| toLocationCountry | maltego.IPv4Address | This transform takes an IP address to a location with the MaxMind free city database. |
| toLocationCountryNetblock | maltego.Netblock | This transform takes a Netblock to a location with the MaxMind free city database. |
To Location [Using nominatim.openstreetmap.org]
Description
Takes GPS Co-ordinates to an address via nominatim.openstreetmap.org
| Display Name | To Location [Using nominatim.openstreetmap.org] |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | Using nominatim.openstreetmap.org |
| Transform Name | toLocationGeoCode |
| Input Entities | maltego.GPS |
| Output Entities | maltego.Location |
| Short Description | Takes GPS Co-ordinates to an address via nominatim.openstreetmap.org |
To Location (broad) [Using nominatim.openstreetmap.org]
Description
Takes GPS Co-ordinates to an broader address via nominatim.openstreetmap.org
| Display Name | To Location (broad) [Using nominatim.openstreetmap.org] |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | Using nominatim.openstreetmap.org |
| Transform Name | toLocationGeoCodeBroad |
| Input Entities | maltego.GPS |
| Output Entities | maltego.Location |
| Short Description | Takes GPS Co-ordinates to an broader address via nominatim.openstreetmap.org |
To Other Sites With Same Code
Description
This transform returns websites that use the same tracking code.
| Spy on Web API | string | | True | False | False |
| Display Name | To Other Sites With Same Code |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | |
| Transform Name | toSitesIdentifier |
| Input Entities | maltego.UniqueIdentifier |
| Output Entities | maltego.Phrase |
| Short Description | This transform returns websites that use the same tracking code. |
To Sentiment [IBM Watson]
Description
This transform will get a sentiment of a Tweet.
| Companies To Ignore | string | [‘icann’, ‘google’, ‘microsoft’, ‘ibm’, ‘facebook’, ‘twitter’, ‘adobe’, ‘creative commons’, ‘hp’, ‘yahoo’, ‘amazon’, ‘youtube’, ‘apple’, ‘ebay’, ‘paypal’] | True | False | False |
| Display Name | To Sentiment [IBM Watson] |
| Owner | Paterva |
| Author | PR |
| Data Source | IBM Watson |
| Transform Name | TweetSentiment |
| Input Entities | maltego.Twit |
| Output Entities | Phrase |
| Short Description | This transform will get a sentiment of a Tweet. |
To Words [English]
| Ignore Retweets | boolean | True | True | True | False |
| Word List Depth | int | 3500 | True | True | False |
| Display Name | To Words [English] |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | English |
| Transform Name | TweetToWords |
| Input Entities | maltego.Twit |
| Output Entities | maltego.Phrase |
| Short Description | |
To Tracking Codes
Description
This transform will look at a website’s source for Google Analytic IDs and AdSense IDs.
| Display Name | To Tracking Codes |
| Owner | Paterva |
| Author | Andrew2 |
| Data Source | |
| Transform Name | uniqueID |
| Input Entities | maltego.Website |
| Output Entities | maltego.UniqueIdentifier |
| Short Description | This transform will look at a website’s source for Google Analytic IDs and AdSense IDs. |
To Email Addresses [Found on web page]
Description
This transform finds the email addresses on the URL
| HTTP timeout (ms) | int | 8000 | True | False | False |
| Display Name | To Email Addresses [Found on web page] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Found on web page |
| Transform Name | URLToEmail_Parse |
| Input Entities | maltego.URL |
| Output Entities | maltego.EmailAddress |
| Short Description | This transform finds the email addresses on the URL |
To Phone numbers [Found on this web page]
Description
This transform finds the phone numbers on the URL
| Display Name | To Phone numbers [Found on this web page] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Found on this web page |
| Transform Name | URLToPhoneNumber_Parse |
| Input Entities | maltego.URL |
| Output Entities | maltego.PhoneNumber |
| Short Description | This transform finds the phone numbers on the URL |
URL to Title
Description
Fetches title from a given URL. Looks for HTTP and simple JS redirects.
| Display Name | URL to Title |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | |
| Transform Name | URLToTitle |
| Input Entities | maltego.URL |
| Output Entities | maltego.WebTitle |
| Short Description | Fetches title from a given URL. Looks for HTTP and simple JS redirects. |
To Website [Convert]
Description
This transform converts an URL to a website
| Display Name | To Website [Convert] |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | Convert |
| Transform Name | URLToWebsite_Convert |
| Input Entities | maltego.URL |
| Output Entities | maltego.Website |
| Short Description | This transform converts an URL to a website |
To Website [Links on this web page]
Description
This transform looks for outgoing links on the URL and show them as websites
| HTTP timeout (ms) | int | 8000 | True | False | False |
| Display Name | To Website [Links on this web page] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | Links on this web page |
| Transform Name | URLToWebsite_Parse |
| Input Entities | maltego.URL |
| Output Entities | maltego.Website |
| Short Description | This transform looks for outgoing links on the URL and show them as websites |
Mirror: Email addresses found
Description
This transform uses a website mirror to spider the site and extract email addresses
| Display Name | Mirror: Email addresses found |
| Owner | Paterva |
| Author | Paterva |
| Data Source | |
| Transform Name | WebsiteToEmailAddress_Mirror |
| Input Entities | maltego.Website |
| Output Entities | maltego.EmailAddress |
| Short Description | This transform uses a website mirror to spider the site and extract email addresses |
To URLs [show Search Engine results]
Description
This transform just dumps the URLs collected.
| Display Name | To URLs [show Search Engine results] |
| Owner | Paterva |
| Author | Paterva |
| Data Source | show Search Engine results |
| Transform Name | WebsiteToURL_Expand |
| Input Entities | maltego.Website |
| Output Entities | maltego.URL |
| Short Description | This transform just dumps the URLs collected. |
Mirror: External links found
Description
This transform uses a website mirror to spider the site and extract links.
| Display Name | Mirror: External links found |
| Owner | Paterva |
| Author | Paterva |
| Data Source | |
| Transform Name | WebsiteToWebsite_Mirror |
| Input Entities | maltego.Website |
| Output Entities | maltego.Phrase |
| Short Description | This transform uses a website mirror to spider the site and extract links. |
To Website Title
Description
Fetches title from a given website. Looks for HTTP and simple JS redirects.
| Request Connect Timeout (s) | string | | True | False | False |
| Request Read Timeout (s) | string | | True | False | False |
| Display Name | To Website Title |
| Owner | Paterva |
| Author | AndrewW |
| Data Source | |
| Transform Name | WebsiteToWebTitle_Mech |
| Input Entities | maltego.Website |
| Output Entities | maltego.WebTitle |
| Short Description | Fetches title from a given website. Looks for HTTP and simple JS redirects. |