I'm being cyberattacked by Tesla, Inc
Points and comments are a snapshot, not live.
Assetnote scanners hired by Tesla are sending exploit payloads to a hobbyist NTP server.
Robin, running a volunteer NTP server under pool.ntp.org, found Assetnote scanners hitting his IP with exploits because pool-ntp.tesla.com is a CNAME to pool.ntp.org, which resolves to his machine. The three AWS-hosted scanner IPs (54.165.75.96, 35.168.63.24, 52.44.200.251) sent 50,000+ requests since August 21, including Log4Shell, SSRF, and path traversal attempts, all using Tesla host headers. Robin emailed Tesla and posted a notice via HTTP 299 responses, but the scanning continues.
What commenters are saying
Commenters split into two camps: those noting this is standard crawler traffic anyone hosting a public server sees, and those arguing the real issue is Tesla accidentally pointing a commercial vulnerability scanner at strangers' infrastructure, which could be illegal. Several pointed out Tesla's CNAME usage violates NTP Pool best practices for vendors. One operator confirmed similar traffic from the same IPs. Suggestions ranged from reporting to AWS to setting up honeypot responses to attract human attention.