# Tesla's scanners spent weeks attacking a stranger's NTP server

> A volunteer time server landed in Tesla's asset inventory, and an automated scanner threw Log4Shell at a hobbyist for three weeks.
- Title: Tesla's scanners spent weeks attacking a stranger's NTP server
- Summary: A volunteer time server landed in Tesla's asset inventory, and an automated scanner threw Log4Shell at a hobbyist for three weeks. If your asset discovery…
- Keywords: security, ntp pool, dns, vulnerability scanning, tesla, technology, startups, Tesla's, scanners, spent, weeks, attacking
- Source: robin’s page — https://dreamstation.systems/personal/tesla.html
- Author: robin
- Published: 2026-09-13T00:00:00+00:00
- Read time: 1 min
- Topics: security, ntp pool, dns, vulnerability scanning, tesla, technology, startups
## Strange hits in the logs
Robin found persistent attack traffic from three AWS addresses, each carrying an Assetnote scanner user agent and a Host header reading pool-ntp.tesla.com, aimed at a hobbyist server.

> they must be mistaking me for an internal Tesla asset
## One CNAME did it
Tesla points pool-ntp.tesla.com at pool.ntp.org, a round robin of thousands of volunteer time servers. Robin runs one. Asset discovery resolved the name and filed a stranger's IP as Tesla property.

> (Sidenote, they should be using a vendor zone, not their own CNAME under tesla.com.)
## Everything in the playbook
Path traversal, webshell uploads, CMS admin probes, SSRF, Log4Shell. 989 requests embedded assetnote-callback.com hostnames and 114 named a canary SSRF domain. The scanner even spoke HTTP at his SSH and mail ports.

> None of their attacks have succeeded, which I'm proud of.
## A sign in the window
On September 8 he started answering that Host with status code 299 and a page on every path saying this is not Tesla infrastructure, hoping a human would read the scanner logs. The traffic kept coming.

> you are throwing exploits at strangers' IPs
## Not just one server
Fellow pool operator Matt Nordhoff had been logging the same three addresses since August 15, over 22,000 hits. Nobody else spoke up, so how much of the pool got swept is still an open question.
## Then a human answered
After more than 50,000 requests since August 21, someone at Assetnote got in touch and shut it down. Tesla, emailed weeks earlier at its vulnerability reporting address, never wrote back.

> Patrik from Assetnote reached out to me with a very gracious message, it has been resolved.
## Key takeaway

If your asset discovery follows a CNAME off your own infrastructure, your security scanning becomes an attack on somebody else's machine.