Well, that would really depend on how you obtained it yourself. When I started walking you through this, I was giving a particular example. That won't always be the way we're going to receive it. Some of the time it can come in the form of a potential breach that has been reported by a bank, “Oh, we believe these IP addresses may have fraudulently accessed accounts.” If that has not necessarily been confirmed, we won't have any evidence to corroborate what has been provided.
We could also simply receive IP addresses and have to determine, based on these IP addresses, whether a crime has been committed, and then obtain information in relation to those to actually further the investigation.