# SPDX-License-Identifier: AGPL-3.0-only
# The category the CrowdSec notifier used for the same scenario (1, DNS
# compromise — the provider's closest name for zone enumeration).
# `include` is empty: the zone asked for is a customer's domain.
report: dns-zone-transfer
categories: [dns-compromise]
says: "Attempted an unauthorised DNS zone transfer (AXFR/IXFR) — zone enumeration"
include: []
