Parses wrong payload IP about cve-2021-44228 HOT 2 OPEN

One thought is to look at splitting the payload from the right to left. eg if we split on the last '/' in /Exploit and take the second to last element in the vector, this would give the correct 10.0.16.1:1389 in both cases. Although it depends on there being that trailing / (and only one of them...) .
Need to way up the risk of introducing FN's at the expense of an edge case that could be post processed in SIEM. note I'm not even sure that the single / in ldap:/10.0.16.1:1389/Exploit constitutes a working exploit.

from cve-2021-44228.

Another thought is to use a split on a regex that caters for working exploits and the potentially not working edge case, something like:
local tmp = split_string(s, ///|:/[0-9]{0,3}.[0-9]{0,3}.[0-9]{0,3}.[0-9]{0,3}/);
Again, depends how big a pain point this is.

from cve-2021-44228.