6667

Port 6667/tcp is the classic Internet Relay Chat port, registered with IANA as ircu with the description "IRCU." Per RFC 7194 (August 2014), the ircu assignment spans TCP/UDP ports 6665–6669; IRC was originally assigned the system port 194/tcp (irc), but the de-facto standard became 6667 and the 6660–6669 range precisely so an IRC daemon need not run with root privileges. IRC is a text-based client/server chat protocol organized around channels and private messages, created by Jarkko Oikarinen in 1988; the original protocol is RFC 1459 (May 1993), revised by RFC 2810–2813 (April 2000). The TLS/SSL variant is ircs-u on 6697/tcp ("Internet Relay Chat via TLS/SSL," reference [RFC7194]). For most of its history 6667 was also the dominant botnet command-and-control channel: infected bots connected to an IRC server and joined a channel to receive operator commands, the prevailing C2 method from roughly 1999 to 2010 before HTTP and peer-to-peer C2 displaced it. A long line of IRC-bot families used it — GTbot (mIRC-based, ~2000), SDBot/rBot (2002), Agobot/Phatbot/Gaobot (2002–04), Spybot (2003), and others — and Nmap's irc-botnet-channels NSE script still checks 6667 for known bot channels; IRC C2 is largely superseded but still appears, including in some modern IoT botnet variants. IRC has also long been used for warez and file-sharing. For an analyst, IRC on 6667 is not inherently malicious, but it is uncommon on modern enterprise endpoints and warrants investigation; outbound 6667 from a server or IoT device is a strong botnet-C2 indicator, so inspect channel names and JOIN/PRIVMSG patterns.

IANA assignment

ircu — "IRCU"; reference (blank in port row; RFC 7194 documents the 6665–6669 assignment); registered for 6667/tcp and 6667/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry; RFC 7194

Range class

registered (1024–49151)

Prevalence

appears in Nmap's top-ports lists (de-facto, nmap-services) [Well-established] — nmap-services file

Related ports

6660–6669 (ircu range), 6697 (ircs-u, IRC over TLS), 194 (irc, original system port), 994 (ircs), 7000 (alt IRC)

Primary use

Internet Relay Chat (client/server text chat)

Other/unofficial uses

historic botnet C2 channel; warez/file-sharing [Well-established/Threat-reported]

Security implications

dominant botnet C2 channel ~1999–2010 (bots join an IRC channel for commands); Nmap irc-botnet-channels NSE checks 6667; many historic bot families; largely superseded but still seen (incl. some IoT botnets)

Typically seen on

IRC servers; historically botnet C2 hosts and infected clients; some IoT devices

Analyst note

IRC on 6667 is not inherently malicious but uncommon on modern enterprise endpoints; outbound 6667 from a server or IoT device is a strong botnet-C2 indicator. Inspect channel names and JOIN/PRIVMSG traffic.