SKILL / Infrastructure
Plans: AgencyIP Abuse History
Examine attributed abuse reports and distinguish reported observations from verified responsibility.
Read the step-by-step user guideIP Abuse History answers what others have reported about an IP address: which kinds of abuse were attributed to it, when the reports were made, and how the pattern has developed over time. Investigators use it when an address is connected to spam, brute-force attempts, fraud or harassment in a case. Nexus returns the attributed reports as evidence-linked findings, each with its date, its reported category and the record it came from.
What you get
A dated history of abuse reports attributed to an IP address, kept separate from any finding of responsibility.
Using IP Abuse History in an investigation
The central distinction is between observation and responsibility. A report says that someone observed activity from an address; it does not say who was behind that activity, and Nexus keeps that boundary visible in every finding. Reports are grouped by period so an investigator can see whether abuse was a single burst, a sustained pattern or an old episode on an address that has since changed hands. Periods with no reports are noted as gaps, not as proof that the address was clean.
The history can be attached to the address entity in the case graph, compared with IP Threat Signals and IP Network Location, and cited in a brief or PDF report with each report’s evidence record intact. IP Abuse History is an Agency-plan Skill built for teams that handle infrastructure attribution in threat intelligence, fraud and law-enforcement contexts and need reported observations documented without overstating what they prove.
Example objectives
Run the Skill directly, or describe the objective in your own words — these are the kinds of questions it is built to answer.
Ask Nexus
“What abuse has been reported against this IP address, and over what period?”
Ask Nexus
“Is the abuse history on this address recent and sustained, or an isolated episode from years ago?”
Ask Nexus
“Which addresses in this list have reported abuse that overlaps with the incident dates?”
How IP Abuse History fits the investigation
A Skill is one move inside a case. The findings stay in the case file, where the evidence behind them can be checked, graphed and reported.
- 01
Choose or describe
Pick the Skill from the Skill Library, or describe the objective in your own words and let Nexus work out which Skills fit the question.
- 02
Review the evidence
Open the evidence record behind any finding and read the original public source before you rely on what it says.
- 03
Add to the case graph
Promote the people, organizations and identifiers you accept into the case relationship graph, straight from their evidence records.
- 04
Brief and report
Turn the case into a BLUF situation brief and, on Pro and Agency, into a structured PDF report with chain of custody.
Evidence before conclusions
What IP Abuse History cannot establish
Nexus keeps supported findings, possible matches, contradictions and information gaps apart instead of blending them into one narrative. These are the boundaries IP Abuse History states up front.
- Abuse reports are allegations or observations submitted by third parties; they do not establish who operated the address or that the subject was responsible.
- Reports may be incomplete, duplicated or outdated, and an address with no reports is not thereby shown to be benign.
- Nexus examines reported history at a point in time and does not monitor an address for new reports.
Best for
Teams that reach for IP Abuse History most often.
Related OSINT concepts
The vocabulary this Skill works in, defined in the glossary.
Related Skills
Skills investigators commonly run next, in the same case.
Frequently asked questions
What does IP Abuse History show for an address?
IP Abuse History in Nexus shows the abuse reports publicly attributed to an IP address, organized by date and by the category of activity reported, such as spam, scanning, brute-force attempts or fraud. Each report is an evidence-linked finding with its record attached, and the dated history makes it clear whether the reports cluster in one period, recur over years or stopped long ago.
Does an abuse report prove the subject was responsible?
An abuse report does not prove that the subject of a case was responsible. Reports record what a third party observed coming from an address, and addresses are shared, reassigned and spoofed. IP Abuse History presents each report as a reported observation and never as a finding of responsibility, so the investigator decides how the history fits the rest of the evidence before drawing any conclusion about an actor.
Which plan do I need for IP Abuse History?
IP Abuse History requires the Agency plan. It is one of four Skills reserved for Agency, together with IP Threat Signals, Breach Pattern Analysis and Cross-Entity Correlation, and with them the Agency Skill Library reaches all 47 Skills. Pro covers 43 of the 47. An investigator on Pro can still examine an address with IP Network Location, DNS Posture and Reverse IP Relationships, but the attributed abuse reports themselves are an Agency capability.
When should I use IP Abuse History instead of IP Threat Signals?
Use IP Abuse History when the question is what was reported and when, for example to check whether reported abuse overlaps with the dates of an incident or to show a sustained pattern over months. Use IP Threat Signals when the question is how much weight the address’s current reputation deserves. Running both keeps the dated reports and the reputation assessment side by side in the case, each linked to its own evidence record.