One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year, according to research published this week by agent security platform Reco. The activity, which Reco has named the City Forum campaign after a domain tied to the attacker's IP address, traces back to one server: 158.220.87.79, hosted on a






![Trained an diffusion model that runs on 264KB of RAM [P]](https://preview.redd.it/8vzcg2x7q3kh1.png?width=140&height=140&auto=webp&s=7a1fb828642c6ddfa5211c2a6f942764e68a21cb)



