Actual CVE-2021-44228 payloads captured in the wild

This post details the actual payloads and statistics observed in the wild during the exploitation of the Log4j vulnerability (CVE-2021-44228). It analyzes blocked exploit requests, the IP addresses originating them, and the geographical distribution of attacks. Specific examples of reconnaissance payloads using LDAP and DNS, as well as evasion techniques like using `${lower}` to bypass simple string blocking, are provided. The post highlights the ongoing nature of these attacks and Cloudflare's continuous efforts to update WAF and firewall rules.