A sustained data scraping operation has been targeting Salesforce and ServiceNow customer portals across various industries since March 2025. Security researchers have identified a single server, IP address 158.220.87.79, hosted by German provider Contabo, as the source of these activities. This server employs a custom-built program, indicated by its use of Go’s net/http library, to extract data from these platforms.
The campaign, dubbed ‘City Forum’ due to a domain linked to the attacker’s IP, has impacted sectors including telecommunications, banking, enterprise software, and public services. While specific organizations remain unnamed, the breadth of affected industries underscores the operation’s extensive reach.
Unlike previous attacks that primarily exploited Salesforce’s older Aura framework, this operation also targets the newer Lightning Web Runtime sites via the UI-API, systematically probing API versions from v56.0 to v66.0. Additionally, the same server aggressively accesses ServiceNow’s Service Portal search endpoint, POST /api/now/sp/search, which lacks extensive public documentation.
The core vulnerability exploited in these attacks is the over-permissioned guest user accounts inherent in both Salesforce and ServiceNow platforms. These guest identities, intended for unauthenticated visitors, possess more access rights than necessary, rendering certain records effectively public. This issue persists even when sites require login credentials for browser access.
To detect such unauthorized activities, security teams are advised to monitor specific indicators. On Salesforce, this includes analyzing AuraRequest and Sites log events for the Go-http-client user agent, the identified IP address, and request paths containing /webruntime/api/services/data. Unusual spikes in self-registration attempts at /SiteRegister and /CommunitiesSelfReg should also raise alerts. For ServiceNow, examining the syslog_transaction table for entries from the suspicious IP and URLs starting with /api/now/sp/search can help identify potential breaches.
Mitigating these risks involves tightening guest user permissions rather than modifying the endpoints themselves, as both the UI-API and ServiceNow’s search endpoint function as designed. For Salesforce, this entails reviewing and restricting guest sharing rules, removing unnecessary object and field-level access, disabling self-registration where not needed, and turning off settings that allow guest users to access public APIs. In ServiceNow, organizations should audit which search sources are exposed to public-facing portals and adjust Knowledge Base read criteria to control anonymous search results.
This ongoing campaign highlights the critical need for organizations to regularly assess and fortify their security configurations, especially concerning default guest user permissions. As attackers continue to exploit such vulnerabilities, proactive measures are essential to safeguard sensitive data and maintain system integrity.
