One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025

Campaign overview

A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year, according to research published this week by agent security platform Reco. The activity, which Reco has named the City Forum campaign after a domain tied to the attacker's IP address, traces back to one server: 158.220.87.79, hosted on a commodity VPS through the German provider Contabo.

Every request from that server carries the same fingerprint, the default user agent of Go's net/http library, which tells researchers the tool behind it is a compiled, purpose-built program rather than anything run from a browser. Passive DNS shows the same domain pointed at that IP as far back as March 2025, and the server has not moved since.

Targets and techniques

Targets identified so far span:

• Telecoms
• Banks and other financial services firms
• Enterprise software vendors, including security and data privacy companies
• Public sector portals

Reco has not named individual organizations. What sets this campaign apart from prior Salesforce guest access abuse, including the widely reported activity attributed to ShinyHunters, is the range of surfaces it touches.

Most known attackers in this space lean on Salesforce's older Aura framework, sending high volumes of guest requests to enumerate objects and page through records. This actor does that too, and Aura still accounts for the bulk of the traffic Reco observed, with one target logging over 560,000 events from the same IP. But the tool also reaches Salesforce's newer Lightning Web Runtime sites through the UI-API, a data layer that has no public write-ups or known scanning tools associated with it, walking through API versions v56.0 through v66.0 in sequence.

On top of that, the same server hammers a native ServiceNow Service Portal search endpoint, POST /api/now/sp/search, that carries almost no public documentation of its own.

Root cause: overly permissive guest access

According to Reco's writeup, the common thread across every technique is the same underlying issue: a guest identity that was granted more access than the site actually needed to serve the public.

Salesforce Experience Cloud sites and ServiceNow portals both maintain a persistent guest user that unauthenticated visitors execute as, and that user cannot be deleted, only restricted. If the guest profile can read a record, the record is effectively public, whether or not the site requires login to view it in a browser.

Detection guidance

The research lays out concrete detection steps for security and IT teams on both platforms.

On Salesforce, defenders with Event Monitoring or Shield can:

• Pull AuraRequest and Sites log events.
• Look for the Go-http-client user agent, the specific IP, and request paths containing /webruntime/api/services/data.
• Watch for spikes in self-registration attempts at /SiteRegister and /CommunitiesSelfReg.

On ServiceNow:

• Filter the transaction log table syslog_transaction by source IP and by URLs starting with /api/now/sp/search.
• Flag guest-created rows and unusual output length as the clearest signal of a live sweep.

Remediation guidance

Remediation, per the research, centers on tightening the guest profile rather than the endpoints themselves, since both the UI-API and the ServiceNow search endpoint are working as designed.

On Salesforce:

• Review guest sharing rules.
• Strip unnecessary object and field-level access from the guest profile.
• Disable self-registration where it is not required.
• Turn off the Experience Builder setting that allows guest users to reach public APIs.

On ServiceNow:

• Map which search sources are exposed to public-facing portals.
• Audit the Knowledge Base read criteria that decide what an anonymous search actually returns.

Ongoing activity and resources

Reco says the infrastructure behind the campaign is still active and the volume is climbing, and the firm has not attributed the activity to a specific named group.

The full technical breakdown, including request signatures, sample queries, and a closer look at how the Service Portal search endpoint decides what to hand back to an anonymous caller, is available in Reco's writeup of the City Forum campaign.

Security leaders weighing how much of their budget to put toward this kind of app exposure, versus other priorities competing for the same dollars, can find a planning framework in Reco's guide to AI security investment, which covers how to size budget, evaluate vendors, and build a business case for the board.