A server operator running a voluntary NTP Pool server discovered they were receiving thousands of automated attack requests from Tesla’s security scanning infrastructure over a two-day period in September 2026.
According to a detailed post by the operator, Robin at dreamstation.systems, the attack traffic originated from three IP addresses in Amazon Web Services infrastructure: 54.165.75.96, 35.168.63.24, and 52.44.200.251. The requests came with Host and Referer headers pointing to pool-ntp.tesla.com and carried Assetnote user agents, attempting various exploit payloads including path traversal, SSRF, Log4Shell, and Text4Shell attacks.
The root cause appears to be a DNS configuration issue. Tesla publishes pool-ntp.tesla.com as a CNAME record pointing to pool.ntp.org, which is a round-robin service distributing traffic across thousands of volunteer-operated NTP servers worldwide. Assetnote, described as a legitimate attack surface management tool (also marketed as Searchlight Cyber), apparently included pool-ntp.tesla.com in its asset inventory as part of Tesla’s infrastructure and began performing automated security scans against all IP addresses the domain resolved to.
The operator documented receiving approximately 8,000 requests over two days, with 989 requests embedding Assetnote callback URLs for Log4Shell detection and 114 for SSRF testing. The attack attempts included 989 callback attempts to assetnote-callback.com hostnames and 114 to canary.assetnotessrf.com. None of the attacks succeeded against the target server.
When the operator responded with HTTP status code 299 on September 8 and posted a notice explaining the situation, the scanning traffic did not stop. As of the time of writing, the operator had received over 50,000 requests since August 21.
After emailing Tesla’s vulnerability reporting address, the operator noted that at least one other NTP Pool operator, Matt Nordhoff, had observed similar scanning since August 15, receiving nearly 23,000 requests from the same three IP addresses combined. The operator speculated that Assetnote may be re-resolving the Tesla subdomain repeatedly and hitting multiple pool member IPs, or may have cached a limited set of pool addresses in its scanning targets.
According to the operator’s email to Tesla, the issue stems from Tesla using its own CNAME under tesla.com rather than a dedicated vendor zone for the NTP Pool reference, which may have contributed to the asset discovery confusion.
Key facts
- Attack traffic came from three AWS IP addresses carrying Assetnote/1.0.0 user agents with exploit payloads including Log4Shell and SSRF attempts
- The root cause was pool-ntp.tesla.com (a Tesla subdomain) CNAMEing to pool.ntp.org, a round-robin service of volunteer NTP servers worldwide
- One operator documented 8,000 requests over two days; over 50,000 total requests since August 21 according to the post
- At least one other NTP Pool operator reported similar scanning traffic since August 15
- None of the attack attempts succeeded against the targeted server