A volunteer operator of a Network Time Protocol (NTP) server recently discovered persistent automated attack traffic targeting their server, originating from IP addresses associated with Amazon Web Services (AWS) and linked to Tesla’s domain. The traffic, identified as coming from Assetnote scanners—an attack surface management tool now marketed as Searchlight Cyber—appears to be the result of a misconfiguration involving Tesla’s subdomain pool-ntp.tesla.com.

Tesla’s subdomain pool-ntp.tesla.com is configured as a CNAME record pointing to pool.ntp.org, the public NTP Pool project that distributes time synchronization services across thousands of volunteer servers worldwide, including the affected operator’s server. This setup has caused Assetnote’s automated scanners to incorrectly classify these volunteer servers as Tesla-owned assets and launch a variety of exploit attempts against them.

The scans included attempts to exploit vulnerabilities such as path traversal, webshell uploads, server-side request forgery (SSRF), and Log4Shell, among others. The operator noted that the scanners used Host and Referer headers referencing pool-ntp.tesla.com and embedded callback URLs associated with Assetnote’s infrastructure. Despite the volume and persistence of these scans—over 50,000 requests since late August—none of the exploit attempts succeeded.

The operator reached out to Tesla’s vulnerability reporting team to inform them of the issue, explaining that the misconfiguration is causing Tesla’s security tools to target unrelated volunteer servers. Tesla has not responded to the inquiry so far. The operator also shared that other NTP Pool participants have observed similar scanning activity from the same IP addresses.

This incident highlights the risks of using corporate subdomains in DNS configurations that point to shared or third-party infrastructure without proper segmentation. It also underscores the potential for automated security tools to misidentify assets, leading to unintended scanning and exploitation attempts against innocent parties. The operator has chosen not to block the scanners to continue monitoring the activity and hopes to raise awareness within Tesla and the broader security community.

The situation remains ongoing, with scans continuing at the time of reporting.