Cyber threat research disclosures have exposed a persistent data scraping campaign operating from a single infrastructure node to extract customer records from enterprise cloud portals. The operation relies on compiled automated tooling to systematically query misconfigured public access endpoints.
The threat activity, dubbed the City Forum campaign, originates from a single VPS server address operating under domain infrastructure established in March 2025. Threat actors utilize a custom Go binary transmitting default user-agent strings to query public-facing Salesforce and ServiceNow customer portals across multiple industry verticals. By targeting unauthenticated API endpoints and permissive public access settings, the adversary systematically scrapes customer profile records, internal ticket details, and business contact lists without triggering standard web application firewall filters.
Exposing public access parameters on enterprise SaaS portals presents ongoing corporate data confidentiality risks. When public customer portals permit unmonitored API querying, administrative misconfigurations allow malicious scraping campaigns to harvest sensitive customer databases over extended operational timelines.
– Perform comprehensive permission audits across public Salesforce and ServiceNow customer portals to restrict public read access.
– Enforce strict API query rate limiting and IP reputation controls across public web gateway tiers.
– Inspect web server ingress logs for high-volume automated traffic originating from IP address 158.220.87.79 or default Go user agents.
– Configure Web Application Firewall inspection rules to block unverified automated data extraction queries targeting portal APIs.
Enterprise SaaS platform defense depends on continuous permission auditing and strict API access verification to ensure public web portals do not expose internal customer records to automated scraping operations. #CodeDefence #Salesforce #ServiceNow #DataScraping #CityForum #AppSec #CloudSecurity
/
