One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025

Research by Reco has identified a single server that has been scraping records from Salesforce and ServiceNow customer portals across various industries for over a year. This activity, referred to as the City Forum campaign, is linked to the IP address associated with the domain name. The server in question is hosted at the IP address 158.220.87.79. The scraping has been ongoing since at least 2025, affecting multiple industries. Reco's research has tied the activity to a single piece of infrastructure, indicating a targeted and sustained effort by the attacker. The campaign's impact and scope are still being assessed.