One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025

The Hacker News 18 August 2026, 14:30 EEST Domains

A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year, according to research published this week by agent security platform Reco. The activity, which Reco has named the City Forum campaign after a domain tied to the attacker's IP address, traces back to one server: 158.220.87.79, hosted on a…

Read the full story on The Hacker News https://thehackernews.com/2026/08/one-attacker-has-scraped-both.html

An expired domain or a forgotten certificate takes a site down just as effectively as an attack. At CrockyHost hosting renewals and SSL are handled for you.

Keep reading

Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure The Hacker News
Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic The Hacker News
Certighost and the Privilege Hiding in Your Certificate Authority BleepingComputer
Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware The Hacker News