map optimizing question

[Roman Vasilyev]

Hello,

I have 2 huge map variables in my nginx.conf
first one contains 350000 hostname records;
second one: 115000;

First map used for some conditional substitution by hostname in my 
module which happening not frequently.

Second one is used for malware detection, so request to this map goes 
with every http request to nginx.

I was wondered that first map is not affecting on performance, but 
second one is decreasing nginx speed about 20%, so my question is, how 
can I optimize malware detection?

I tryed to check content_type:
map $host $mlw_table {
hostnames;

defult 0;

...
...
.zzuie.info 1;
.zzzz.ellmada.co.cc 1;
.zzzzzz.com 1;
}

set $malware 0;
if ( $content_type ~* text/ )
{
   set $malware $mlw_tbale;
}

if ( $malware ) { return 406; }

error_page 406 @406;
location @406 {
   rewrite  .* /af_protect.html break;
}

it doesn't work: not $content_type not $upstream_http_content_type
other option include this checking in my module byt in this case in need 
implement "return" statement inside it too (if possible).

Could you give me some ideas how better optimize performance in my case.