diff --git a/README.md b/README.md
index 79ed9ca..b6bbeb5 100644
--- a/README.md
+++ b/README.md
@@ -282,6 +282,12 @@ Audited 2026-07-20 — which public hostnames require credentials:
   design — it needs subnet-level (CIDR) banning instead, which risks
   blocking legitimate traffic sharing that block (e.g. carrier NAT). Left
   as routine scan noise for now; revisit if it escalates.
+  **Follow-up 2026-07-26**: rechecked — the original three `/24`s are gone
+  from current logs entirely (that specific campaign appears to have moved
+  on). `apache-noscript` shows normal jail activity (42 total bans, 3
+  currently banned) from ordinary repeat-offender IPs already caught by
+  per-IP thresholds, not a new distributed single-shot pattern. No
+  escalation; still fine to leave as-is.
 
 - **No real nameserver redundancy**: 2026-07-19, `ns1.jayfield.org` and
   `ns2.jayfield.org` were registered as this domain's NS records at the
diff --git a/TODO.md b/TODO.md
index 9cca6e5..1d47057 100644
--- a/TODO.md
+++ b/TODO.md
@@ -280,6 +280,13 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
       default thresholds and mail stack but showed much lower per-IP volume
       in this pass — worth a follow-up check if it starts trending the same
       way.
+      **Follow-up 2026-07-26**: checked `postfix-sasl` — still just scattered
+      background noise, not a coordinated campaign. Top offender
+      (`172.94.9.203`) logged 32 hits but all from late June/early July, none
+      since; current activity is single/double attempts from many different
+      IPs (no repeated per-IP low-and-slow pattern like the dovecot spray).
+      `findtime=30m`/`maxretry=3` defaults left as-is — no fix needed unless
+      this changes.
       Fixed: `/etc/fail2ban/jail.d/dovecot-findtime.local`, same values as
       the `sshd` fix (`findtime=1d`, `maxretry=4`, `bantime=1d`). Applied via
       `fail2ban-client reload dovecot`; verified live with