This is an excellent write up about how the OpenDNS system works to identify malicious DNS activity so they can block it. The idea of a data firehose that consumers can listen to and work with is a powerful one and is something I've found quite useful in systems I work on as well if you're looking to either listen in to the running system or if you want to collect data for analytics.

For more, check out "Speed, Security, and Safety through DNS":

http://blog.opendns.com/2013/12/11/speed-security-safety-dns...

You can read/watch an overview of the previous generation of OpenDNS stats here: http://rcrowley.org/2009/06/23/building-opendns-stats-at-vel...

TLDR; use redis