# Notes.:  regex to match the password failure messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>\S+)

# Fail2Ban configuration file for named (bind9). Trying to generalize the
#          structure which is general to capture general patterns in log
#          lines to cover different configurations/distributions
#
# Author: Yaroslav Halchenko
#
# Adaptation and changement made by Dieter Fleischer 19th of August 2009
# Filter Name : named-zone-transfer.conf
#

[Definition]

#
# Daemon name
_daemon=named

#
# Shortcuts for easier comprehension of the failregex
__pid_re=(?:\[\d+\])
__daemon_re=\(?%(_daemon)s(?:\(\S+\))?\)?:?
__daemon_combs_re=(?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:)
#       hostname       daemon_id         spaces
# this can be optional (for instance if we match named native log files)
__line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile.
# Values: TEXT
#
failregex = %(__line_prefix)sclient <HOST>#\S+: zone transfer '.*' denied\s*$


# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

[named-zone-transfer]

enabled  = true
port     = domain,953
# protocol = tcp
filter   = named-zone-transfer
logpath  = /var/log/named/security.log
maxretry = 2

    82.146.38.160 (Tue Aug 18 23:53:36 2009)
    82.146.38.160 (Tue Aug 18 23:54:32 2009)
    82.146.38.160 (Tue Aug 18 23:59:04 2009)
    82.146.38.160 (Tue Aug 18 23:59:51 2009)
    82.146.38.160 (Wed Aug 19 00:00:23 2009)
    82.146.38.160 (Wed Aug 19 00:01:06 2009)
    82.146.38.160 (Wed Aug 19 00:01:48 2009)
    82.146.38.160 (Wed Aug 19 00:02:09 2009)
    82.146.38.160 (Wed Aug 19 00:03:03 2009)
    82.146.38.160 (Wed Aug 19 00:04:25 2009)
    82.146.38.160 (Wed Aug 19 00:04:56 2009)
    82.146.38.160 (Wed Aug 19 00:15:23 2009)
    82.146.38.160 (Wed Aug 19 00:15:58 2009)
    82.146.38.160 (Wed Aug 19 00:26:18 2009)
    82.146.38.160 (Wed Aug 19 00:29:13 2009)

Date template hits:
0 hit(s): Month Day Hour:Minute:Second
0 hit(s): Weekday Month Day Hour:Minute:Second Year
0 hit(s): Weekday Month Day Hour:Minute:Second
0 hit(s): Year/Month/Day Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
0 hit(s): Day/Month/Year:Hour:Minute:Second
0 hit(s): Year-Month-Day Hour:Minute:Second
1829 hit(s): Day-Month-Year Hour:Minute:Second[.Millisecond]
0 hit(s): TAI64N
0 hit(s): Epoch
0 hit(s): ISO 8601

Success, the total number of match is 899

However, look at the above section 'Running tests' which could contain important
information.
sd-1xxxx:/etc/fail2ban/filter.d#

Chain fail2ban-named-zone-transfer (1 references)
target     prot opt source               destination
DROP       all  --  82.146.38.160        0.0.0.0/0
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

logging {
    channel security_file {
        file "/var/log/named/security.log" versions 3 size 30m;
        severity dynamic;
        print-time yes;
    };
    category security {
        security_file;
    };
};

mkdir /var/log/named

Nov 15 17:18:22 sd-16xxx named[15734]: client 68.59.189.51#59177: query (cache) 'credixxxx.com/MX/IN' denied

^[A-Z][a-z]{2,3}\s[0-9]{2}\s[0-9]{2}[:][0-9]{2}[:][0-9]{2}\s[A-Za-z0-9-]{2,9}\snamed[\[][0-9]{1,5}[\]]:\sclient\s[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\#[0-9]{1,5}:\squery\s\(cache\)\s'[a-zA-Z-\.\/]{2,120}'\sdenied$

# iptables -A INPUT -s 89.105.115.146 -j DROP
# iptables-save