The detection part is interesting: you'd run that query on regular basis then push the result (all /etc/hosts entries as expl) to your log server