One Attacker Scrapes Salesforce and ServiceNow Portals Since 2025

A single threat actor has been systematically scraping data from Salesforce and ServiceNow customer portals for over a year, according to research by Reco, an agent security platform. The campaign, dubbed ‘City Forum’ after a domain tied to the attacker’s IP, originates from one server (158.220.87.79) hosted on a commodity VPS via German provider Contabo. Every request carries the default Go net/http user agent, indicating a purpose-built tool.

Targets span telecoms, banks, financial services, enterprise software vendors, and public sector portals. The attacker exploits guest user access in Salesforce Experience Cloud and ServiceNow portals, which cannot be deleted, only restricted. Techniques include abusing Salesforce’s Aura framework (with one target logging over 560,000 events) and the newer Lightning Web Runtime UI-API, walking through API versions v56.0 to v66.0. The same server also hits ServiceNow’s native Service Portal search endpoint (POST /api/now/sp/search), which has little public documentation.

Reco provides detection steps: On Salesforce, use Event Monitoring or Shield to look for the Go-http-client user agent, the specific IP, and paths containing /webruntime/api/services/data, plus spikes in self-registration attempts. On ServiceNow, filter syslog_transaction by source IP and URLs starting with /api/now/sp/search, flagging guest-created rows and unusual output length. Remediation focuses on tightening guest profiles, reviewing sharing rules, disabling self-registration, and auditing Knowledge Base read criteria.

The infrastructure remains active with climbing volume. Reco has not attributed the campaign to a specific named group. The full technical breakdown is available in Reco’s writeup.