Jumpstart Your Person of Interest Investigations with People Data Labs and Maltego

With nearly 2.5 billion unique profiles available for searching, People Data Labs allows investigators to advance their person of interest investigations in seconds and with a single click.

Founded in 2015, People Data Labs began as recruiting software intended to help companies better understand and source candidates. Today companies around the world and across industries use PDL’s data to build compliant people data solutions.

Please also note that People Data Labs data access in not available for Law Enforcement customer segment.

What type of information can we query with the People Data Labs Transforms? 🔗︎

The PDL Transforms allow you to query the following information about a person:

• Email address
• Country
• Employer
• Interests
• Job Title
• Location
• Phone Number
• Skills
• Social Media Accounts

Let’s check an example of this. We will start with a Person Entity. In this case, we will use PDL co-founder and CEO Sean Thorne as our starting point, and we will run the To Person [PeopleDataLabs] Transform to get all the information associated with Sean.

You are required to provide at least one of the following fields (Locality, Region, Company, School, Location, Postal Code) when running the To Person [PeopleDataLabs] Transform to query data. Otherwise, the Transform will not return any result.

Once you provide the information and click on Run, a new Entity will be created by Maltego containing all the details associated with the person you are investigating.

Let’s take a look at the details tab from the new Person Entity.

As mentioned above, we can query different details associated with a Person. Let’s check a few of these Transforms.

The To Emails [PeopleDataLabs] Transform allows you to retrieve work and personal emails associated with a Person.

The To Phone Numbers [PeopleDataLabs] Transform allows you to retrieve phone numbers owned by a Person.

The To Social Networks [PeopleDataLabs] Transform returns social media accounts linked to a Person.

The To Location [PeopleDataLabs] Transform provides information on where a person resides or has resided in the past.

Those are just a few of the Transforms available on the People Data Labs Hub item. We encourage you to test these and the rest.

Additionally, you can use the following pieces of information to pivot into a Person Entity.

• Phone Number
• Affiliation (Social Media Account)
• Email Address

How to Access People Data Labs Data in Maltego 🔗︎

People Data Labs Transforms for Maltego are available for all Maltego Pro and Enterprise users via the following methods:

Data Subscriptions 🔗︎

Simply purchase a monthly data subscription for People Data Labs in our web-shop, starting at 16 USD per month for 50 Transforms per month!

Bring Your Own Key 🔗︎

If you are an existing People Data Labs customer, simply plug in your own API key to install the Hub item and get started.

For those using the People Data Labs Hub item via data subscriptions, Maltego will provide you with the number of remaining queries available on the output window every time you run a PDL Transform.

Use Case: Romance Scammers Investigation 🔗︎

Now that we’ve covered the basics, let’s take a look at a real-world investigation based on an indictment of a group of individuals located in the United States, according to the indictment published by the United States Justice Department.

Taken from www.justice.gov

Although the indictment includes 23 individuals, we will focus our efforts on the four individuals mentioned on the court document obtained by The Record, a cyber intelligence news site by Recorded Future.

• Solomon Esekheigbe
• Chidindu Okeke
• Ngozi Okeke
• Isaac Asare

We will start by creating the Person Entities as well as any Aliases mentioned in the document for those four individuals

Let’s select the Person Entities and run the To Person [PeopleDataLabs] Transform.

As we can see, PDL returned new Entities for all of them.

Now, let’s retrieve the information from these 4 Entities by running the Expand Details Transform set from People Data Labs.

We can see some immediate connections between these Entities based on their location and some interesting details such as companies mentioned on their profiles, skills, personal and work email addresses, and LinkedIn profiles. One of them even returned numerous phone numbers associated with them.

As we mentioned before, you can also pivot from other Entities such as Phone Numbers. Let’s test this by selecting the Phone Number Entities in our Graph and running the To Person [PeopleDataLabs] Transform.

We can see how a couple of the phone numbers can be associated with another person with the same last name as one of the defendants, which means that there is a high chance these two individuals are related. However, this does not mean that they have taken any part in the actions taken by the defendant.

Another exciting find is that the skills associated with one of the individuals match the profile of one of the defendants as detailed on the court documents.

Let’s check one of the LinkedIn profiles returned by People Data Labs to look for more clues on these individuals. If we open Solomon Esekheigbe’s Linkedin profile, something interesting catches our attention: Under the “People Also Viewed” section, we can see some of the individuals mentioned on the indictment as well.

As usual, we can also combine the new Entities with existing data sources such as Social Links to map out the social media presence of these individuals and further confirm the relationship between them.

Let’s take the People Data Labs Person Entity for Solomon Esekheigbe and run the [LinkedIn] Search Transform by Social Links Pro.

We will also query the details of the “People Also Viewed” section using another of Social Links Pro Transform called [LinkedIn] Get People Also Viewed to bring the details of these individuals into our Graph so that we can continue with our investigation.

As we can see some of the people mentioned in the “People Also Viewed” section has been also mentioned in the indictment, we will convert the new LinkedIn profiles into Person Entities to highlight the individuals already in our Graph.

We found eight additional individuals potentially associated with Solomon Esekheigbe, some of which are also mentioned on the court documents, lets run the To Person [PeopleDataLabs] the Expand Details Transform set on the new Entities.

This is only a brief example of how you could use the People Data Labs data set to kickstart your Person of Interest investigations, with only a few Transforms we were able to map out connections between the defendants and uncover details such as phone numbers and email addresses that can be used to expand our investigation

Note: A grand jury indictment is not evidence of guilt. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Don’t forget to follow us on Twitter and LinkedIn and sign up for our email newsletter to stay updated on the latest news, tutorials, and events.

Happy investigating!