Port 22

1Password confirms attacker tried to pull list of admin users after Okta intrusion