SKILL / Infrastructure
Plans: AgencyIP Threat Signals
Review available reputation and threat indicators, including their dates, confidence and limitations.
Read the step-by-step user guideIP Threat Signals answers whether an IP address carries a documented reputation: has it been flagged for scanning, spam, malware distribution or other hostile activity, how recently, and how much weight those flags deserve? Investigators use it when an address appears in logs, phishing infrastructure, a fraud pattern or a subject’s footprint and they need a qualified reading before escalating. Nexus reviews the available indicators and returns them as evidence-linked findings, each carrying its date, the category of activity reported and a confidence note.
What you get
An assessment of an IP address’s reputation and threat indicators with dates, confidence and caveats stated.
Using IP Threat Signals in an investigation
The assessment is designed to be read critically. Indicators are shown with their age, because a flag from years ago on an address that has since been reassigned tells a different story from one raised last week. Signals that stem from shared infrastructure, such as a cloud range or a carrier-grade network, are marked so the investigator does not attribute another tenant’s behavior to the subject. Absent or contradictory indicators are recorded as information gaps, not as a clean bill of health.
Findings can be attached to the address entity in the case graph, combined with IP Network Location and IP Abuse History for a fuller picture, and cited in a brief or PDF report with the evidence record and its limitations preserved. IP Threat Signals is an Agency-plan Skill intended for teams that routinely triage infrastructure indicators in threat intelligence, fraud and corporate security work and need each indicator documented with its caveats.
Example objectives
Run the Skill directly, or describe the objective in your own words — these are the kinds of questions it is built to answer.
Ask Nexus
“Does this IP address have any current reputation or threat indicators, and how recent are they?”
Ask Nexus
“Which of the addresses in this phishing kit’s infrastructure have documented malicious activity?”
Ask Nexus
“Are the flags on this address likely tied to the subject or to a shared hosting range?”
How IP Threat Signals fits the investigation
A Skill is one move inside a case. The findings stay in the case file, where the evidence behind them can be checked, graphed and reported.
- 01
Choose or describe
Pick the Skill from the Skill Library, or describe the objective in your own words and let Nexus work out which Skills fit the question.
- 02
Review the evidence
Open the evidence record behind any finding and read the original public source before you rely on what it says.
- 03
Add to the case graph
Promote the people, organizations and identifiers you accept into the case relationship graph, straight from their evidence records.
- 04
Brief and report
Turn the case into a BLUF situation brief and, on Pro and Agency, into a structured PDF report with chain of custody.
Evidence before conclusions
What IP Threat Signals cannot establish
Nexus keeps supported findings, possible matches, contradictions and information gaps apart instead of blending them into one narrative. These are the boundaries IP Threat Signals states up front.
- Reputation signals can be stale and may reflect shared infrastructure rather than the subject, so a flag is an indicator to corroborate, not a conclusion.
- The absence of indicators does not establish that an address is benign or unused.
- Nexus reviews indicators at a point in time; it does not monitor an address or send alerts.
Best for
Teams that reach for IP Threat Signals most often.
Related OSINT concepts
The vocabulary this Skill works in, defined in the glossary.
Related Skills
Skills investigators commonly run next, in the same case.
Frequently asked questions
What kind of indicators does IP Threat Signals review?
IP Threat Signals reviews the reputation and threat indicators available for an address, such as flags for scanning, spam, brute-force attempts, malware hosting or listing on a block list. Each indicator is returned as an evidence-linked finding with its date, the category of activity reported and a note on confidence, so an investigator can see at a glance which signals are current and which are historical or weakly supported.
Does a threat flag mean the address owner did something malicious?
A threat flag does not establish that the address owner, or the subject of a case, did anything malicious. Flags are raised by third parties observing traffic, often from shared ranges where many tenants use the same address, and they can persist after an address changes hands. IP Threat Signals marks shared-infrastructure and stale indicators explicitly so the finding is weighed as an indicator, not treated as a conclusion.
Which Nexus plan includes IP Threat Signals?
IP Threat Signals is one of the four Agency-only Skills in the Nexus Skill Library, alongside IP Abuse History, Breach Pattern Analysis and Cross-Entity Correlation. Pro includes 43 of the 47 investigative Skills, and the Agency plan includes all 47. Investigators on Pro can still use IP Network Location, DNS Posture and Reverse IP Relationships for infrastructure work.
How is IP Threat Signals different from IP Abuse History?
IP Threat Signals assesses the current reputation of an address by weighing available indicators, their age and their confidence. IP Abuse History instead lays out the individual abuse reports attributed to the address over time, so the investigator can see the pattern of what was reported and when. Nexus treats the two as complementary: one gives a qualified present-day reading, the other a dated record of past observations.