One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
Reco tracks the City Forum campaign: one Contabo VPS has scraped Salesforce and ServiceNow guest portals across finance, telecom and public sector since March 2025.
68
Threat actor
City Forum (unattributed)
- Mentions · 7d0
- Mentions · 30d0
- All mentions1
- First seenAug 18, 2026
- Last mentionedAug 18, 2026
Timeline
1 articles · newest firstAppears with
- Contabovendor · 1
- ShinyHuntersthreat actor · 1
- ServiceNowvendor · 1
- ServiceNow Service Portalproduct · 1
- Recovendor · 1
- Salesforce Experience Cloudproduct · 1
- Salesforcevendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.