Follow up on postfix-sasl and apache-noscript watch items

Both were left as "revisit if it escalates" notes from earlier audits.
Checked live logs on alpha via SSH (port 10022): postfix-sasl remains
scattered low-volume noise, not a coordinated low-and-slow campaign like
the dovecot spray; the original three /24s behind the apache-noscript
distributed scan are no longer active, current activity is normal
per-IP jail behavior. No fixes needed for either; also reconfirmed the
dyndns per-user auth binding gap is still present and unfixed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -282,6 +282,12 @@ Audited 2026-07-20 — which public hostnames require credentials:
   design — it needs subnet-level (CIDR) banning instead, which risks
   blocking legitimate traffic sharing that block (e.g. carrier NAT). Left
   as routine scan noise for now; revisit if it escalates.
+  **Follow-up 2026-07-26**: rechecked — the original three `/24`s are gone
+  from current logs entirely (that specific campaign appears to have moved
+  on). `apache-noscript` shows normal jail activity (42 total bans, 3
+  currently banned) from ordinary repeat-offender IPs already caught by
+  per-IP thresholds, not a new distributed single-shot pattern. No
+  escalation; still fine to leave as-is.
 
 - **No real nameserver redundancy**: 2026-07-19, `ns1.jayfield.org` and
   `ns2.jayfield.org` were registered as this domain's NS records at the

TODO.md

@@ -280,6 +280,13 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
       default thresholds and mail stack but showed much lower per-IP volume
       in this pass — worth a follow-up check if it starts trending the same
       way.
+      **Follow-up 2026-07-26**: checked `postfix-sasl` — still just scattered
+      background noise, not a coordinated campaign. Top offender
+      (`172.94.9.203`) logged 32 hits but all from late June/early July, none
+      since; current activity is single/double attempts from many different
+      IPs (no repeated per-IP low-and-slow pattern like the dovecot spray).
+      `findtime=30m`/`maxretry=3` defaults left as-is — no fix needed unless
+      this changes.
       Fixed: `/etc/fail2ban/jail.d/dovecot-findtime.local`, same values as
       the `sshd` fix (`findtime=1d`, `maxretry=4`, `bantime=1d`). Applied via
       `fail2ban-client reload dovecot`; verified live with