Single Contabo VPS at 158.220.87.79 Scrapes Salesforce Aura/Lightning and ServiceNow Portals Since March 2025

The City Forum infrastructure operates from a static German VPS that has not moved since passive DNS first resolved a tied domain in March 2025. Every request carries the default Go net/http user agent and targets guest-accessible endpoints on Salesforce Experience Cloud and ServiceNow Service Portals. Reco observed the same server enumerate objects via Aura, step through Lightning UI-API versions v56.0-v66.0, and POST to the undocumented ServiceNow search endpoint across telecom, banking, and public-sector tenants.

Guest profiles remain the common failure point. Both platforms expose persistent unauthenticated identities that cannot be deleted; any record readable by the guest user is effectively public. The actor exploits this on surfaces with minimal prior public tooling, distinguishing the campaign from earlier ShinyHunters-style Aura scraping. No technical attribution to a named group exists; the infrastructure fingerprint is consistent but unlinked to prior clusters.

Detection relies on Event Monitoring for AuraRequest and Sites events plus syslog_transaction on ServiceNow, filtering for the Go user agent, the fixed IP, and anomalous output lengths. Remediation requires stripping guest sharing rules and disabling self-registration rather than endpoint changes. Volume continues to rise with no infrastructure relocation observed.

Within twelve months the same misconfigurations will enable additional commodity actors to replicate the pattern at scale, eroding data integrity across SaaS tenants that still treat guest access as low risk.