Here's [1] an example of using Masscan to scan the IPv4 space for shellshock.

[1] http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-in...