My server is being included in what seems to be bungled internal Tesla vulnerability scanning

Server operators
1

Over roughly the past two days, my HTTP server (that happens to be on the same IP as my NTP server) has received ~8,000 requests from 54.165.75.96 and 35.168.63.24, UA Assetnote/1.0.0 (ExposureScan), with many templated exploit payloads. Every payload used pool-ntp.tesla.com as the target hostname. I assume their asset inventory accidentally included that subdomain which does not actually point to Tesla assets.

I have emailed Tesla about this and am not concerned about it (I’m patched against everything they tried and I have no reason to believe this wasn’t an innocent accident). However I am curious if anyone else is seeing this, or if they resolved it to my IP once and kept hitting it.

2

For the record, pool-ntp.tesla.com is a CNAME to pool.ntp.org.

I’m not seeing such requests in my logs.

3

It’s a spammer, as it referred to something else before.
Not the pool.
It’s bullshit.

4

Yeah I’m aware of that, which is why the mistake on their part regarding accidentally including it in their list of assets to scan is obvious

5

At least one of my US NTP Pool servers got it:

$ sudo rg -zFI pool-ntp.tesla.com access.log* | awk '{print $1}' | sort | uniq -c | sort -gr | head
   9126 54.165.75.96
   7461 35.168.63.24
   6123 52.44.200.251
     11 64.227.103.50
      6 146.190.142.16
      4 3.101.230.148
      3 3.88.188.142
      3 3.101.216.68
      2 54.213.2.72
      2 54.202.10.40

(Is there a better way to do that? There is probably a better way to do that.)

The 3 big IPs have “ExposureScan” in the user-agent for most of the requests. It’s been happening since at least 2026-08-15 (UTC).

Also got a handful of miscellaneous abuse/scan requests to that hostname from a couple dozen other IPs.

6

Link goes to here… https://www.galsys.eu/

It’s spam.

7

Which link?

If you’re talking about the pool-ntp tesla hostname, you understand that it’s a CNAME that points to the NTP pool, right? So if you visit it in a web browser you may see any web site that a random pool volunteer has running on their IP address.

If that’s not what you mean, can you elaborate? It’s very confusing to just keep thoring out these “it’s spam” “bullshit” responses.

8

No it refers to the website is gave, all the time.

9

Can you please explain what you are talking about? What web site that who gave?

$ host pool-ntp.tesla.com
pool-ntp.tesla.com is an alias for pool.ntp.org.
pool.ntp.org has address 212.71.233.40
pool.ntp.org has address 85.199.214.102
pool.ntp.org has address 94.15.142.187
pool.ntp.org has address 212.132.222.19
pool.ntp.org mail is handled by 0
10

In addition to the responses by grifferz above:

$ host www.galsys.eu
www.galsys.eu has address 172.233.59.169
www.galsys.eu has IPv6 address 2600:3c0e::f03c:94ff:fe24:f6a2

https://www.ntppool.org/scores/172.233.59.169
https://www.ntppool.org/scores/2600:3c0e::f03c:94ff:fe24:f6a2

This means the server Bas ran into is a legit NTP pool server that also happens to host a website. This is very common. https://www.ntppool.org/en/join.html says “… but sometimes people type pool.ntp.org and are then surprised to get a random web page” which is exactly what Bas is seeing here. In short, nothing to see here, move on. Next message in this topic better be about someone else seeing those scans in their logs, or something else that is relevant to the scanning. Let’s stop the spam thread here.

11

Thanks lol. This thread is so frustrating.

To restate more succintly: pool-ntp.tesla.com CNAMEs to pool.ntp.org. This is normal and fine. But it looks like that some Tesla automated scanner rolled my IP from it and is trying to exploit it. I can tell, because among their attacks, are attacks over HTTP, which include Host headers. Is anyone else seeing this?

12

I would repport it to @ask so he can take action against that pool.
As typical company-pools have their own servers, at least I would expect them to have their own.

13

Anyone with a domain can put entries in it that point at anything else and there’;s absolutely nothing Ask can do about that outside of some obscure corners of trademark law.

OP is already doing as much as they can: report to Tesla, find others who are affected. I understood that to eb the purpose of this thread.

14

I know that. But Ask can remove the company-pool after giving a warning.
Company-pools should not (ab)use ntp-servers without consent of the NTP-owner.

So yes, Ask can and should take action if they use servers that do not want to be in a company-pool.

In my opinion there should be an opt-in for servers to be used by a company.

15

It’s a CNAME under tesla.com. Ask cannot do that

16

Bas you really need to undersgand there is absolutely no obligation for you to participate in each and every thread in this forum. In particular the many many topics where you have no clue what you are talking about, you are more than welcome to stay out. On behalf of many of us - thank you!

17

Just see it now, it’s a pool that is under tesla.com, you are right, he can’t do that.
My mistake.