GoKawiilAssetnote scanners mistakenly attack NTP volunteer server linked via Tesla CNAME
A volunteer running an NTP pool server discovered persistent attack traffic, including Log4Shell-style payloads, arriving from AWS-hosted IPs tied to the security firm Assetnote. The traffic carried Host headers referencing pool-ntp.tesla.com, a domain Tesla points via CNAME to the public NTP Pool, causing Assetnote's scanners to treat the volunteer's server as a Tesla-owned asset. The issue was reported and resolved after Assetnote's team responded.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident shows how attack-surface management tools can misfire when companies use shared or third-party infrastructure without isolating it under a dedicated vendor subdomain, exposing unrelated volunteer services to automated exploit attempts. It's a cautionary example for both DNS hygiene and the risks of aggressive automated security scanning against public shared services.
- Tesla's CNAME for pool-ntp.tesla.com pointed to the shared NTP Pool instead of a dedicated vendor zone.
- Assetnote's automated scanners misidentified a volunteer NTP server as Tesla infrastructure and attacked it with exploit payloads.
- The issue was acknowledged and resolved after direct contact with Assetnote.
Raspberry Pi 5 Single Board Computer — Perfect for anyone who runs their own nginx box and actually reads their access logs, like the author here. A Pi 5 makes a great low-power self-hosted web server or honeypot for watching all that drive-by scanner traffic hit your IP.
See Raspberry Pi 5 Single Board Computer on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: dreamstation.systems, 2026-09-13
Published there as: “I'm being cyberattacked by Tesla, Inc”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.