ABSTRACT
Early bots relied upon IRC for command and control, frequently performing egress connections over TCP port 6667. Over time, this matured and led to the development of Web-based C&C egress communications with Web servers over TCP port 80. is helps attackers avoid easy detection, because TCP port 80 is the default port and protocol for Web communications commonly allowed in most organizations and home networks.
