Port 22

First malware known to have used DNS over HTTPS - passive network visibility go *pooof*