I'm being cyberattacked by Tesla, Inc

Tesla Inc. is experiencing an unusual cyberattack, with persistent traffic coming from three specific IP addresses. The traffic originates from three scanners: 54.165.75.96, 35.168.63.24, and 52.44.200.251. All of these IPs are associated with Amazon Web Services (AWS). The attack surface management tool, now called Searchlight Cyber, is using continuous threat exposure scanners for automated checks on customers' assets.

Assetnote mistakenly identifies the reporter's server as an internal Tesla asset due to the use of pool-ntp.tesla.com, a CNAME to pool.ntp.org. The NTP Pool is a round-robin of volunteer NTP servers that the reporter is part of, and the asset discovery mistakenly includes every IP that pool-ntp.tesla.com can resolve. The reporter has contacted Tesla about the issue but has not received a response.

The attacks have included various exploits like path traversal, webshell uploads, probing software internals, SSRF, Log4Shell, and more, with over 50,000 requests from Assetnote hosts since August 21. The reporter has observed that Tesla's scan is targeting every IP that pool-ntp.tesla.com can resolve, causing unnecessary traffic on the reporter's server.