  The critical remote-code-execution (RCE) Log4Shell is a severe vulnerability
that was disclosed to the public on December 10, 2021. It exploits a bug in the
wide-spread Log4j library. Any service that uses the library and exposes an
interface to the Internet is potentially vulnerable.
  In this paper, we measure the rush of scanners during the two months after
the disclosure. We use several vantage points to observe both researchers and
attackers. For this purpose, we collect and analyze payloads sent by benign and
malicious communication parties, their origins, and churn. We find that the
initial rush of scanners quickly ebbed. Especially non-malicious scanners were
only interested in the days after the disclosure. In contrast, malicious
scanners continue targeting the vulnerability.
