Scan detection now also considers previously detected scan targets to validate a host as being a (scan) attacker