Many of these attacks seem to use pastebin. I will add a hosts entry pointing pastebin to localhost in my production servers.