Table 2: Contribution of events typified a potentially malicious source given in heuristic.

EventWeight

Entire zone transfer attempt (AXFR)100%
Partial transfer zone attempt (IXFR)50%
Incorrect query volume, 50 to 75% on average per source75%
Incorrect query volume exceeding 75%100%
Query volume, up 50%, the average number of access by origin50%