You can, but you do not need to ban host names with pfctl.
You can do it using /etc/hosts. In fact, that is the way I have been doing it for years. It is lighter on resources than pfctl, since you do not need to solve the names, nor inspect traffic. It has also the advantage of blocking all instances of a known name, since site names can resolve to several IP addresses nowadays.
$ dig A cnn.com
; <<>> DiG 9.8.3-P1 <<>> A cnn.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22656
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 4, ADDITIONAL: 2
;; QUESTION SECTION:
;cnn.com. IN A
;; ANSWER SECTION:
cnn.com. 242 IN A 18.104.22.168
cnn.com. 242 IN A 22.214.171.124
;; AUTHORITY SECTION:
cnn.com. 172707 IN NS ns3.timewarner.net.
cnn.com. 172707 IN NS ns2.p42.dynect.net.
cnn.com. 172707 IN NS ns1.timewarner.net.
cnn.com. 172707 IN NS ns1.p42.dynect.net.
;; ADDITIONAL SECTION:
ns1.timewarner.net. 172707 IN A 126.96.36.199
ns3.timewarner.net. 172707 IN A 188.8.131.52
;; Query time: 5 msec
;; SERVER: 192.168.201.1#53(192.168.201.1)
;; WHEN: Sun Nov 22 07:35:00 2015
;; MSG SIZE rcvd: 186
The way to do it is editing hosts
and populating it with the address 0.0.0.0 followed with the name of the site you want to block. People used to used 127.0.0.1 instead, however due to Windows compatibility problems, and due to 0.0.0.0 signalling you do not have even to try to open the connection, 0.0.0.0 is used nowadays.
If your concerns are malware, besides adding your own, you can use this list as a starting point, which is one of the better known.
"Blocking Unwanted Connections with a Hosts File"
Here is an example of some of my entries in /etc/hosts
If you still want to use pf, it seems you have to use it together with relayd, for it not to block IP addresses, but to block sites.
I have found a slide talking about it:
As a footnote, if you want a good graphical firewall in OS/X, Little Snitch is excellent, and also blocks at application level.