Severe Risk
IP 137.131.43.224 is a high-risk address with a threat level of 10/10, linked to web application attack probes detected by automated honeypot sensors in October 2025. This US-based Oracle cloud infrastructure address generated 341 total abuse reports, with the dominant recent activity category being Web App Attack across 20 individual detections.
The IP operates within AS31898 (ORACLE-BMC-31898), Oracle's cloud networking infrastructure in the United States, and was first and last reported during October 2025 according to available community and sensor data. Despite the maximum threat level assignment, the confidence score sits at 64%, suggesting some uncertainty in the attribution or classification of observed behaviour. The activity frequency metric of 0/10 indicates that recent automated sensor hits are minimal or non-existent at present, though the historical report volume signals persistent scanning behaviour targeting web-facing applications. All 20 recent reports for this dominant threat category were sourced exclusively from automated honeypot sensors, which are designed to emulate vulnerable web application endpoints and capture probing activity.
Web application attacks encompass exploitation attempts against vulnerabilities in web-facing software, including injection flaws, authentication weaknesses, and misconfiguration abuse as documented in the OWASP Top 10. An IP conducting such probes is systematically scanning the internet for accessible web services running outdated or unpatched applications. Even if this address belongs to a legitimate Oracle cloud customer conducting security testing, the sheer volume of reports and its classification as a threat by multiple independent honeypot sensors means it poses a credible risk to any exposed web application lacking proper firewall protection.
Site operators should block or rate-limit this address at the network perimeter firewall and implement a Web Application Firewall rule set tuned to detect and mitigate probing patterns associated with web app attack techniques. Keeping all web-facing applications fully patched, enforcing strong authentication mechanisms, and reviewing access logs for similar reconnaissance activity from adjacent IP ranges will reduce exposure. Deploying tools such as fail2ban or equivalent intrusion-prevention systems can automate blocking of repeated probe attempts originating from this address.
SG 
CL 
AU