Tesla-linked DNS setup allegedly sends Assetnote scans to volunteer NTP server
A server operator says automated Assetnote probes generated more than 50,000 requests after a Tesla subdomain resolved to an NTP Pool address. The claim has not been independently verified.
A server operator has alleged that vulnerability scanners associated with Assetnote mistakenly treated an NTP Pool server as a Tesla asset, sending more than 50,000 automated requests since 21 August.
The account, published on Hacker News, centres on pool-ntp.tesla.com, which reportedly CNAMEs to pool.ntp.org. The NTP Pool distributes traffic among volunteer servers, meaning the Tesla subdomain can resolve to infrastructure not owned or operated by Tesla.
The operator said traffic from three AWS IP addresses arrived with pool-ntp.tesla.com references and Assetnote user agents. The reported probes included path traversal, webshell uploads, CMS and software-internals checks, SSRF, Log4Shell and Text4Shell detection attempts.
According to the operator, 989 requests contained Assetnote callback hostnames and 114 referenced an Assetnote SSRF canary domain. The operator said the probes did not succeed, but generated unrelated HTTP traffic against services including SSH, Postfix and Dovecot.
On 8 September, the operator began returning an HTTP 299 response containing a notice intended to alert whoever was monitoring the scans. The operator also said Tesla had been contacted but had not responded.
The scanner attribution and the proposed chain of asset discovery, DNS resolution and mistaken inclusion of the server remain allegations. The source does not establish whether Tesla commissioned or authorised the scans. Another NTP Pool operator reportedly observed similar traffic from 15 August.
