Out of the box (at least on my text 1.8 JVM): corbaname, dns, iiop, iiopname, ldap, ldaps, rmi

For full details of how this works, use a vulnerable log4j version, log a simple (bad) lookup, and step through with a debugger for a while.

Sources:

  - https://github.com/JetBrains/jdk8u_jdk/blob/master/src/share/classes/com/sun/naming/internal/ResourceManager.java#L422
  - https://github.com/JetBrains/jdk8u_jdk/blob/master/src/share/classes/javax/naming/spi/NamingManager.java#L558
  - https://github.com/JetBrains/jdk8u_jdk/tree/master/src/share/classes/com/sun/jndi/url

By default the class will be named "com.sun.jndi.url.<scheme>.<scheme>URLContextFactory"

So for example, if your schema, the class will be "com.sun.jndi.url.ldap.ldapURLContextFactory".

But also note that many of these schemes can return referrals/redirects to other protocols.