Securityonderzoekers waarschuwen voor City Forum scraping: een campagne waarbij gedurende meer dan een jaar records zijn opgehaald uit Salesforce en ServiceNow customer portals. Opvallend is dat het niet gaat om een incident dat zich beperkt tot één specifieke pagina of één oud aanvalspatroon, maar om meerdere ingangen en databronnen binnen dezelfde omgevingen.
Volgens het onderzoek draait de activiteit om één centraal stuk infrastructuur. Dat maakt de dreiging tegelijk concreet voor detectie en urgent voor herstel, omdat de server in de waarnemingen actief blijft en het datavolume toeneemt.
What is City Forum scraping exactly?
The campaign is named “City Forum” after a domain that’s linked to the attacker’s IP address. In the investigation, all traffic is traced back to the same source: a server with IP address 158.220.87.79. That server is hosted on a commodity VPS with German provider Contabo.
Every request coming from that infrastructure shows the same characteristic: the default user agent of the Go language library net/http. Researchers interpret this as evidence that it’s a compiled, purpose-built tool rather than browser-like behavior.
In addition, passive DNS indicates that the same domain has been pointing to this IP address since March 2025. It also appears that the server was not moved during the period under study.
From Aura to Lightning: multiple Salesforce surfaces
Part of the City Forum scraping looks strongly similar to well-known misuse patterns involving Salesforce guest access. Many attackers focus on Salesforce’s older Aura framework, generating high volumes of guest requests to enumerate objects and then walk through records.
In Reco’s observations, Aura indeed makes up a large share of the traffic. For example, one target reported more than 560,000 events originating from the same IP address.
However, the investigation reports an extra element that distinguishes City Forum scraping: the same server also visits Lightning Web Runtime sites via the UI-API. In doing so, API versions are iterated through (from v56.0 up to v66.0), and according to the report there are no public write-ups or known scanning tools that typically cover this path.
For defenders, this means you shouldn’t only look for signals that match Aura-focused campaigns, but also stay alert for patterns targeting UI-API request routes.
ServiceNow is also hit via a seemingly obscure endpoint
Besides Salesforce, the campaign also targets ServiceNow. The investigation states that the attacker looks for the native ServiceNow Service Portal and repeatedly uses a specific endpoint: POST /api/now/sp/search.
This route isn’t known for extensive public documentation, making it difficult for teams to recognize it precisely based on “standard knowledge” or existing blocklists.
Still, City Forum scraping makes that consistency visible: the same source, the same fingerprint profile, and request behavior that matches an automated sweep through the search functionality.
The real cause: overly permissive guest access
What links the different techniques, according to the investigation, isn’t a magical payload or a vulnerability in the endpoint itself, but a conceptual issue: a guest identity is granted more access than is needed to serve the website or portal publicly.
Both Salesforce Experience Cloud and ServiceNow portals have a persistent guest user that anonymous visitors use. The report emphasizes that this guest identity can’t be removed easily—only limited.
The result is direct: if those guest profiles are allowed to read a record, that record is effectively public in practice, even if the website appears to require login in the browser. Attackers therefore abuse the gap between “UI access” and “data access”.
How do you detect City Forum scraping on Salesforce?
Reco provides concrete steps for detection in Salesforce. The focus is on logs and recognizable request characteristics.
Use Event Monitoring or Shield
With Event Monitoring or Shield, teams can retrieve related event and request details. The guidelines specifically look for:
- events involving AuraRequest and Sites
- the recurring Go-http-client user agent profile
- the specific IP address that shows up repeatedly
- request paths referencing /webruntime/api/services/data
Additionally, the report pushes a second type of signal: spikes in self registration. Think of requests on paths such as /SiteRegister and /CommunitiesSelfReg, because automated campaigns often try to force registration or bypass it.
Note: if you only look for “big dump” indicators, you may miss parts of City Forum scraping. After all, it’s about stacking accessible data-layer APIs.
How do you detect City Forum scraping on ServiceNow?
On ServiceNow as well, researchers describe how to boil the behavior down to clear transaction-level signals.
Filter by source IP and search endpoint
In the syslog_transaction table, you can filter transactions on two things:
- the source IP (in this case the fixed attacker IP)
- URLs that start with /api/now/sp/search
Because the sweep happens anonymously, defenders also report that “guest created” rows and a striking output length (unusual output length) are among the most clear indicators that it’s an ongoing data retrieval attempt.
Where Salesforce often centers on request paths and log events, ServiceNow here leans more toward transaction-level signals combined with portal search behavior.
Remediation: focus mainly on guest profiles
The investigation is clear about where remediation has the most impact: not so much “fixing the endpoints,” but reducing the permissions of the guest identity.
Salesforce: limit guest sharing and disable self registration where it isn’t needed
For Salesforce, according to Reco, this means:
- reviewing guest sharing rules
- removing unnecessary object- and field-level access from the guest profile
- disabling self registration when it isn’t required
- turning off the Experience Builder setting that allows guest users to reach public APIs
These steps cut to the core of City Forum scraping: once the guest can no longer read a record, the data is no longer “usefully public,” even if an endpoint technically responds correctly to legitimate public requests.
ServiceNow: audit what knowledge can be returned anonymously
On ServiceNow, the remediation aligns with the same principle. According to the investigation, it involves:
- mapping which search sources are exposed to public facing portals
- auditing the Knowledge Base read criteria that determine what an anonymous search caller receives
This way you prevent search functionality from unintentionally returning more content than the organization wants to share publicly.
Why this kind of app exposure deserves extra budget
Reco reports that the infrastructure behind City Forum scraping is still active and volumes are increasing. The group isn’t tied to a specific threat actor known by name.
For security leaders, this creates a familiar tension: how do you weigh investments in limiting app exposure against other priorities? In that context, Reco points to a planning framework for AI security investment, focused on estimating budget, evaluating vendors, and justifying decisions to the board.
The practical takeaway remains the same, though: if guest access is too broad, automated tools can turn data access into a long-running scrape. Detection and hardening must therefore move together.
Handy next step: also check for related attack patterns
City Forum scraping isn’t the only form of abuse that relies on misconfiguration or overly broad access. If you want a broader picture of how attackers bypass access hurdles in cloud and portal environments, you can also look for signals related to credential theft via collaboration platforms. That theme comes up in articles such as
