That makes so much sense I rewrote it immediately using File::Tail and Proc::Daemon. By the way this piped version works, but probably won't scale so well as you generously pointed out. Thank you.

#!/usr/bin/perl -w

use strict;
use Fcntl qw(:DEFAULT);
use File::Tail;
use Net::Netmask;
use Net::Whois::IANA;
use Proc::Daemon;
use SDBM_File;

Proc::Daemon::Init;

my $bye  = join '|', (
 'strings known to occur',
 'in custname and orgname',
);
my $bad = 'some\.bad\.host|other\.worse\d+';

my $file = File::Tail->new("/path/to/ip_log");
my $iana = Net::Whois::IANA->new;

tie (my %seen, 'SDBM_File', '/some/sdbm', O_RDWR|O_CREAT, 0666)
or die "$!";

while (defined (my $ip = $file->read)) {
  chomp $ip;
  next if exists $seen{$ip};
  $seen{$ip} = 1;

  my $problem = 0;
  my $host = `host $ip` or next;
  $problem = 1 if $host =~ /$badhosts/i;

  if ($problem or $host =~ /(not found|timed out)/) {
    $iana->whois_query(-ip=>$ip);

    my $inetnum  = $iana->inetnum || '';
    my $custname = $iana->{QUERY}->{custname} || '';
    my $orgname  = $iana->{QUERY}->{orgname}  || '';

    next unless $inetnum 
    and ($problem or $custname or $orgname);

    if ($custname =~ /($bye)/i or $orgname =~ /($bye)/i){
      my $mask = Net::Netmask->new($inetnum);
      `iptables -A INPUT -s $mask -j DROP`;
    }
  }
}
untie %seen;
[download]