The professional companies do it for everyone, while he'll be doing this for his own small company.

Part of the job of maintaining the list can be done with yet another Perl script that looks at the daily proxy logs and shows only the new URLs (the already seen ones being split between black and white list) and lets one decide which list they belong to. After the first few painful weeks, you'd only get a few new sites a day, most of them probably harmless. Having a starting point for the black list would surely help.

Using Regexp::Assemble could probably boost the black/white list performance.