Our friends at topsy tried to go stealth, and new requests look like this:

GET /2014/04/heartbleed-and-xine-project HTTP/1.1
Host: blog.flameeyes.eu
Connection: Keep-Alive
User-Agent: Mozilla/5.0 ()
Accept-Encoding: gzip,deflate

Blacklist their hosts *and* filter out the User-Agent.