City Forum campaign scraped Salesforce and ServiceNow portals via one server
Source headline: One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
Intelligence Summary
Reco reports that one piece of infrastructure has been scraping data from Salesforce and ServiceNow customer portals across multiple industries for more than a year. The activity is linked to a campaign Reco calls the City Forum campaign. Reco traces the behavior back to a single server at 158.220.87.79. A domain tied to the attacker’s IP address is cited as part of the tracing. This raises the risk of unauthorized access to customer portal records. Monitor for scraping indicators and investigate portal data access logs tied to the exposed infrastructure.
Recommended Action
Confirm whether the affected technology is in use in your environment before deciding on remediation. Until then, watch authentication and outbound traffic logs for the indicators described in the source. This signal rests on a single report, so corroborate it before acting on anything irreversible.