Franc, I'm thinking that that information isn't available at the point where the stream is sampled. I think that would be available from the HTTP Proxy though via the Live Log.
Cheers - Bob
Sophos UTM Community Moderator Sophos Certified Architect - UTM Sophos Certified Engineer - XG Gold Solution Partner since 2005
And that would only delay the display slightly. Check the DNS cache, display what's there, and, for the rest, display a blank but have DNS look up the domain so that it's available the next time the IP appears.