Shieldlist

bind Gratuit

Un serveur DNS BIND faisant autorité : transferts de zone refusés.

Télécharger le pack tar.gz des fichiers listés ci-dessous

Règles (1)

À propos de ce pack

An authoritative nameserver running BIND with allow-transfer { none; }: whoever asks for a zone transfer is enumerating zones, and one refused AXFR/IXFR is a verdict — a day's ban on every port, a week on a return.

What it reads

BIND's security log — a channel of its own with print-time yes (the named/security.log a logging { channel security_log { file "/var/log/named/security.log"; print-time yes; severity info; }; category security { security_log; }; } writes), or the same messages through syslog. Category dns:

logs:
  - {path: /var/log/named/security.log, log: dns, ports: [53]}

The parser keys on the client and the verdict (client @0x… IP#port (zone): zone transfer '…' denied), so either file reads the same. The zone asked for is captured (a facet), never reported.

Rules and policy

Refused recursive queries (query (cache) … denied, the open-resolver scans) are not counted: they are the background noise of any authoritative server and ban nothing under CrowdSec either.

Translated from the operator's lrob/dns-zone-transfer-probe scenario (CrowdSec, © its author, MIT), figures measured on a nameserver over four weeks.

Parseurs (1)

Les briques : chaque parseur nomme un journal, un préfiltre peu coûteux et la regex qui extrait l'adresse.

bind-transfer-denied dns 
# A refused zone transfer, as BIND logs it — in its own security log
# (channel with `print-time yes`, no syslog prefix):
#   2026-08-14T14:05:29.166 security: error: client @0x7f9ae42a3c98 203.0.113.9#62834 (example.org): zone transfer 'example.org/AXFR/IN' denied
# or through syslog (`named[pid]: client @0x… 203.0.113.9#62834 (example.org): zone transfer 'example.org/AXFR/IN' denied`).
# The pattern keys on the client and the verdict, whatever came before
# them, so it reads either file. Category `dns`; the zone is captured
# (a facet: which zones the enumerators go for), the line's own time is
# not read.
parser: bind-transfer-denied
log: dns
prefilter: "zone transfer"
regex: "client @0x[0-9a-f]+ (?P<ip>[0-9a-fA-F.:]+)#\\d+ \\((?P<zone>[^)]*)\\): zone transfer '(?P<transfer>[^']*)' denied"

Signalements

dns-zone-transfer This address asked our authoritative DNS server for a full zone transfer (AXFR/IXFR) it is not entitled to. A zone transfer hands over every record of a domain at once — the reconnaissance step before targeted attacks on the hosts it lists. Only secondary servers we name may ask; anyone else is blocked at the first attempt. Please check what runs on this address. 
# The category the CrowdSec notifier used for the same scenario (1, DNS
# compromise — the provider's closest name for zone enumeration).
# `include` is empty: the zone asked for is a customer's domain.
report: dns-zone-transfer
categories: [dns-compromise]
says: "This address asked our authoritative DNS server for a full zone transfer (AXFR/IXFR) it is not entitled to. A zone transfer hands over every record of a domain at once — the reconnaissance step before targeted attacks on the hosts it lists. Only secondary servers we name may ask; anyone else is blocked at the first attempt. Please check what runs on this address."
include: []

Fichiers