A threat-intelligence feed labels an IP address malicious based on observations from a year ago. It belongs to shared cloud infrastructure today. How should an analyst use it?

1. Block the entire cloud provider permanently without review
2. Discard all intelligence because one indicator is old
3. Treat the feed as conclusive evidence of every connection's intent
4. Assess recency, confidence, and local context before acting