I dont know if its just me or if also others made a similar observation, but for the past three days there is a huge number of single page requests (only one single GET for the root page) coming from many different IP addresses. Those are predominantly (>50%) Brazilian addresses and all with the same user agent.
The notable thing is simply that all those requests are one single GET and all with the same user agent, however coming from a wide variety of addresses (most Brazil though). With the recent bash vulnerability I'd be tempted to believe these were probe requests, but what makes me doubt this is the sheer number of different addresses from different networks and the GET request to /.
Anybody having an idea whats going on?