TCP Port 6667 – IRC (Internet Relay Chat)
Port 6667 is the conventional port for IRC (Internet Relay Chat), the multi-server text-based chat protocol that defined real-time online communication for much of the 1990s and 2000s. Although the port has no formal IANA assignment in the data shown here, by long-standing convention TCP/6667 is the standard plaintext IRC port across every major IRC network. TLS-protected IRC (IRCS) typically uses port 6697.
IRC was created by Jarkko Oikarinen at the University of Oulu in 1988 as a replacement for an earlier multi-user chat program on the same server. The protocol grew quickly through the early Internet and was first standardized in RFC 1459 in 1993, with later revisions in RFC 2810 through 2813 in 2000. The architecture is a federation: many independent networks (EFnet, IRCnet, Undernet, DALnet, freenode, Libera Chat, OFTC, and dozens of smaller ones), each comprising multiple linked servers, each carrying its own set of channels with names typically beginning with the # character.
IRC’s heyday was the late 1990s and 2000s, when it was the default coordination tool for open-source software communities, online gaming clans, hacker culture, and a wide swath of internet subcultures. Major projects including Linux kernel development, Debian, Mozilla, and many others ran their primary developer chat on IRC. Most have since migrated to Slack, Discord, or Matrix-based platforms; Libera Chat remains the primary contemporary IRC network for free and open-source projects.
Inbound TCP/6667 to a designated IRC server is normal in environments that operate one. Inbound TCP/6667 to any other host is unusual. Outbound TCP/6667 from end-user devices is uncommon in modern enterprise environments, where it is generally blocked at the firewall, but is legitimate for IRC clients on home networks or on devices belonging to users who participate in IRC-based communities.
About TCP Port 6667
Port 6667 is not assigned to any service in the IANA Service Names and Port Numbers Registry. Ports in this numerical range can be assigned by IANA but this specific port has no current registration.
Security Considerations
The defining security narrative for port 6667 is its role as the dominant command-and-control channel for malware in the IRC era of botnets. From the late 1990s through approximately 2010, IRC was the standard C2 mechanism for Windows botnets: a compromised host would join a hidden channel on a public IRC network (or on an attacker-controlled server), take commands from operators in the channel, and report results back. Entire malware families were built on this pattern, including Sub7 (1999), Agobot (2002) and its many descendants in the SDBot / Rbot / GAOBOT family, and a long tail of mIRC-script-based bots that ran inside the popular Windows IRC client. Commodity botnet kits sold in underground markets through the 2000s nearly all used IRC C2 by default.
The pattern eventually shifted to HTTP and HTTPS C2 channels, which were harder for defenders to filter and could blend into normal web traffic. Peer-to-peer C2 architectures and domain-generation-algorithm rendezvous followed. IRC C2 lost prominence in the Windows botnet world but remained common in Linux and IoT botnets well into the 2020s, where the simpler protocol fit the constrained environments of compromised embedded devices.
Our data shows 17 IDS rules referencing port 6667. Ten are policy-violation rules that flag ordinary IRC client behaviors (nick changes, channel joins, messages, DCC file transfer requests) on networks where IRC traffic itself is considered a policy issue. Three are explicit malware C2 rules, and one is classified specifically as command-and-control. The remaining rules cover historical exploitation of IRC server software, including a topic-buffer overflow and a parse-overflow in IRC traffic affecting the Ettercap network analyzer.
Two malware families are curated against port 6667 in our data. Siloscape, mapped to MITRE ATT&CK Software S0623, is a Windows container escape malware disclosed by Palo Alto Networks Unit 42 in June 2021. Siloscape targeted Kubernetes environments running Windows containers and used IRC as its C2 channel, an unusual choice for a 2021 malware family that reflected the operator’s preference for a low-cost, high-deniability command channel. The other family, MAGICHOUND.MPK, appears in our data without a curated MITRE mapping; the name suggests an association with the MagicHound activity cluster (also tracked as APT35 / Charming Kitten), although the specific tool variant is not confirmed in the rule data.
Defensive practice for environments that do not specifically need IRC is straightforward: TCP/6667 should be blocked outbound at the network edge, and any inbound TCP/6667 traffic to managed hosts should be investigated. For environments that legitimately use IRC, traffic should be restricted to known-good servers, and any outbound IRC traffic from non-IRC-using hosts should trigger alerting.
Inbound TCP/6667 from the public internet is unusual in 2026 outside of designated IRC servers and is widely treated as a configuration mistake or unauthorized service. Outbound TCP/6667 from end-user workstations to unfamiliar IRC servers is uncommon and worth investigating.
IDS Rule References
17 IDS / security rules reference TCP port 6667. Treat that number as context, not a danger score. Many detection rules are written against groups of ports rather than one service, web ports especially, so common web alternate ports inherit large counts while genuinely sensitive services can show few rules or none. Presence in IDS rules does not mean traffic on this port is malicious.
Rule categories (top 5): policy-violation (10), trojan-activity (3), attempted-user (2), command-and-control (1), misc-attack (1).
Sample rule descriptions for TCP port 6667:
- SERVER-OTHER CHAT IRC topic overflow
- POLICY-SOCIAL IRC nick change
- SERVER-OTHER CHAT IRC Ettercap parse overflow attempt
- POLICY-SOCIAL IRC message
- POLICY-SOCIAL IRC DCC file transfer request
Malware Rule References
A meaningful share of the IDS rules that reference this port are malware related.
7 of the 17 IDS rules that reference TCP port 6667 are malware related. That describes detection coverage across the whole internet, not anything about your machine or your network.
Families observed (top 2): MAGICHOUND.MPK (1), Siloscape (1).
Data Sources
This information is compiled from: Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), Snort Community Rules (GPLv2), and MITRE ATT&CK (Apache 2.0).