Would you recommend IP blocking to ward off this type of attack or do the C&C servers change so fast it isn't worth the effort?