This script will read from rsyslog pipe and block any IP (if desired) that does an unauthorized AXFR petition.

rsyslogpipe_axfr.sh

#!/bin/bash

somepipe=/var/log/rsyslog.pipe

while true
do
   if read line <$somepipe
   then
      if grep -i --line-buffered -P '^(?=.*named)(?=.*cache)(?=.*denied)' $line;
      then
         offendingIP="$(grep -P '^(?=.*named)(?=.*cache)(?=.*denied)' $line | egrep '([0-9]{1,3}\.){3}[0-9]{1,3}')"
         echo Your offending IP is $offendingIP
         # AYOR
         # iptables -A INPUT -i eth0 -s $offendingIP -j DROP
      f
   fi
done