Currently, if the scanner gets a connection on port 5432 and reads an 'N' followed by a disconnect / hang, that can be interpreted as a detection. That may need to be tweaked.