City Forum Campaign Scrapes Salesforce & ServiceNow Portals Since 2025

A single attack infrastructure has been systematically extracting records from Salesforce and ServiceNow customer portals across multiple industries for more than a year, according to research published this week by SaaS security firm Reco. Researchers have named the activity the City Forum campaign after a domain linked to the attacker's IP address, 158.220.87.79, a commodity VPS hosted by German provider Contabo. Every request from that server carries the default Go net/http user agent (Go-http-client), signaling a compiled, purpose-built scraping tool rather than anything browser-driven. Passive DNS records show the same domain pointed at that IP as far back as March 2025, and the server has not relocated since. Confirmed targets span telecoms, banks and financial services firms, enterprise software vendors including security and data privacy companies, and public sector portals, though Reco has not named individual victims.

What distinguishes City Forum from prior Salesforce guest-access abuse, including activity widely attributed to ShinyHunters, is the breadth of surfaces it reaches. Most known actors in this space lean on Salesforce's older Aura framework, firing high volumes of guest requests to enumerate objects and paginate through records. This actor does that too, and Aura still accounts for the bulk of the traffic Reco observed, with one target logging more than 560,000 events from the same IP. But the tool also walks Salesforce's newer Lightning Web Runtime sites through the UI-API, a data layer with no prior public research or known scanning tooling, iterating through API versions v56.0 through v66.0 in sequence. The same server additionally hammers a native ServiceNow Service Portal endpoint, POST /api/now/sp/search, that carries almost no public documentation. Defenders investigating suspicious traffic can correlate source infrastructure with a WHOIS lookup on the attacking IP or domain, and use a port scanner to profile the VPS for additional open services tied to the campaign.

According to Reco's writeup, the common thread across every technique is the same misstep: a guest identity granted more access than the site actually needs to serve the public. Salesforce Experience Cloud sites and ServiceNow portals both maintain a persistent guest user that unauthenticated visitors execute as, and that user cannot be deleted, only restricted. If the guest profile can read a record, the record is effectively public, whether or not the site requires login to view it in a browser. The research also highlights how the attacker's stable fingerprint, a single IP and the Go-http-client user agent, makes detection straightforward for teams with the right telemetry. On Salesforce, defenders with Event Monitoring or Shield can pull AuraRequest and Sites log events and search for the Go-http-client user agent, the 158.220.87.79 IP, and request paths containing /webruntime/api/services/data, alongside spikes in self-registration attempts at /SiteRegister and /CommunitiesSelfReg. On ServiceNow, the syslog_transaction table can be filtered by source IP and by URLs targeting the sp/search endpoint to surface the same activity.