A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months
Reco tracks City-Forum, an actor abusing Salesforce and ServiceNow guest-user access from one IP for 17 months to enumerate portal data.
62
Product
ServiceNow portal
- Mentions · 7d0
- Mentions · 30d0
- All mentions1
- First seenAug 12, 2026
- Last mentionedAug 12, 2026
Timeline
1 articles · newest firstAppears with
- Salesforce Experience Cloudproduct · 1
- City-Forumthreat actor · 1
- Recoorganization · 1
- telecom operatorsvictim · 1
- banksvictim · 1
- Salesforceorganization · 1
- ServiceNowvendor · 1
- public-sector portalsvictim · 1
- ServiceNoworganization · 1
- Salesforcevendor · 1
- ShinyHuntersthreat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.