As someone who scans the internet (but not with hacked machines), I try every version of TLS to determine support. If you support older versions I scan more frequently to see when they are turned off.
Feel free to point to this comment as evidence that logs should not be trusted.
Feel free to point to this comment as evidence that logs should not be trusted.