match on dns "malicious domain" and old browsers

Are there any scripts created already for matching and generating a notice
based on bad domains being queried? Also, I create a signature for
matching against a user agent string but I see this info is already pulled
in the logs. How can I create a notice for matching against something like
IE 6 being used?