dns-zone-transfer Free

A refused DNS zone transfer (AXFR/IXFR) — zone enumeration

Category

dns

Threshold

1/10m

Ban policy

dns-probe

Report

dns-zone-transfer

Parsers

bind-transfer-denied

Why it is written this way

The rule file View raw

# One refused zone transfer is a verdict. The nameservers run
# `allow-transfer { none; }`: no legitimate AXFR/IXFR client exists,
# secondaries refresh from their masters over an outbound connection
# this never touches — so whoever asks is enumerating zones. Measured
# under CrowdSec on one nameserver over four weeks: 1 099 attempts from
# 482 addresses, methodical enumerators (one AXFR per zone, back for
# weeks) and a tail of single shots, all from rented infrastructure.
# Banned on every port for a day and climbing: an address banned on a
# nameserver cannot make ordinary queries either — accepted, a
# legitimate secondary would have been in allow-transfer.
rule: dns-zone-transfer
description: "A refused DNS zone transfer (AXFR/IXFR) — zone enumeration"
category: dns
parsers: bind-transfer-denied
threshold: 1/10m
ban: dns-probe
report: dns-zone-transfer