Port 22

Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network