Dossier
Reco
Coverage of Reco in the Nexus archive.
- One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year. According to research published by agent security platform Reco, this activity was named the City Forum campaign and traces back to server 158.220.87.79.