[mcwhy]

It could also be used for IP reputation, running ssh can be a sign of a proxy or other server/service that website owners might want to block.

[jimsi]

I think single SYN packet would be enough to know whether this port open or not, but they trying to gather full banner.