Comment by agwa

Are you seeing any from IP addresses besides 209.126.230.72, which is Robert Graham scanning the Internet[1]?

[1] http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-in...