A volunteer operator of an NTP Pool server recently discovered that their system was subjected to thousands of automated scanning requests and exploit attempts originating from IP addresses linked to Amazon Web Services. The traffic was traced back to Assetnote, a legitimate attack surface management company now branded as Searchlight Cyber, which uses continuous scanning tools to monitor customer assets. The scans targeted the operator’s server because Tesla’s subdomain pool-ntp.tesla.com is configured as a CNAME to pool.ntp.org, the NTP Pool service that includes thousands of volunteer servers, including the operator’s.
Assetnote’s scanning system appears to have mistakenly classified the operator’s server as part of Tesla’s infrastructure due to the DNS configuration. This led to repeated attempts to exploit vulnerabilities such as path traversal, SSRF, Log4Shell, and other web application weaknesses. The operator noted that the scanning hosts used the pool-ntp.tesla.com hostname in requests and carried Assetnote user agents, indicating the scans were part of Assetnote’s automated checks.
The operator reached out to Tesla to inform them of the issue, highlighting that the subdomain’s DNS setup caused unintended scanning of unrelated volunteer servers. Despite sending a detailed notification, the scanning continued for several days. The operator also shared that none of the exploit attempts were successful and that the situation was being monitored.
This incident underscores the risks of misconfigured DNS records and the challenges in managing large-scale automated security scans. It also highlights the importance for organizations to carefully manage subdomains and asset inventories to avoid inadvertently targeting third-party infrastructure. The operator’s experience serves as a reminder that automated security tools can sometimes produce false positives that impact unrelated parties.
The operator continues to observe the scanning activity and has engaged with the NTP Pool community to determine if others are affected. While the traffic has not ceased immediately, the operator expressed willingness to share logs with Tesla or Assetnote to resolve the matter.