Relatedly, the thought of properly storing your web server's full access logs indefinitely comes to mind, for a baseline of "until I write some exactingly speci

Relatedly, the thought of properly storing your web server's full access logs indefinitely comes to mind, for a baseline of "until I write some exactingly specific filtering logic and I get 0 unclassified results back out". Doesn't have to happen immediately, but by all means hoard 50GB of traffic logs until you do get it done. That sort of thing. You'd naturally be capturing the requested host here, ideally along with all other request headers. And ideally flagging unknown host headers in close to real time, so you can have fun with your visitors next time they say hello :>