This is an excellent write up about how the OpenDNS system works to identify malicious DNS activity so they can block it. The idea of a data firehose that consumers can listen to and work with is a powerful one and is something I've found quite useful in systems I work on as well if you're looking to either listen in to the running system or if you want to collect data for analytics.