In brief: Reco has traced a scraping campaign active since 2025 against Salesforce and ServiceNow portals to a single server (158.220.87.79).
According to research by agent security vendor Reco, a single piece of infrastructure has been extracting records from Salesforce and ServiceNow customer portals across multiple industries for over a year. The campaign, named “City Forum” after a domain linked to the attacker’s IP address, traces back to a single server.
Reco has attributed the activity to the IP address 158.220.87.79, which is operated at a hosting provider. The campaign name “City Forum” derives from a domain that, according to the security researchers, is associated with this IP address. According to Reco, the access has been ongoing continuously since 2025 and affects Salesforce and ServiceNow customer portals across multiple industries.
What matters for CISOs is that this is not a series of isolated incidents at individual tenants, but a systematic scraping campaign run from the same infrastructure over an extended period against two widely used SaaS platforms for customer relationship management and IT service management. Both systems frequently contain sensitive customer data, support tickets and internal process information that, if accessed without authorization, can be leveraged for follow-on attacks such as social engineering or targeted phishing campaigns.
At the time of publication, the source provides no further technical details on the access methods used, the organizations affected, or the scope of the exfiltrated data. Security teams should add the IP address 158.220.87.79 and indicators associated with the “City Forum” campaign to their own threat intelligence feeds and review the access logs of their Salesforce and ServiceNow instances for corresponding patterns.
Source: thehackernews.com · Published August 18, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.