Port 6660 – IRC (Alternate)

TCP

Port 6660 is an alternate IRC (Internet Relay Chat) port. IRC traditionally uses ports 6660-6669 for client connections with port 6667 being the primary default. Port 6660 is unencrypted – use port 6697 for IRC over TLS. IRC remains critical infrastructure for open-source project coordination and some botnet command-and-control.

Port Number

6660

Protocol

TCP

Service

Internet Relay Chat

Range

IANA Registered (1024–49151)

Description

IRC on port 6660 is one of the standard range of IRC client connection ports (6660-6669). IRC servers typically listen on multiple ports in this range for redundancy and load distribution. The protocol is text-based and unencrypted by default. Despite the rise of Discord and Slack, IRC remains the coordination channel for many open-source projects (Libera.Chat, OFTC), Linux distributions, and security communities. IRC is also abused as a botnet C2 channel – compromised machines connect to IRC channels on non-standard ports to receive commands. Network monitoring should flag unexpected outbound connections to ports 6660-6669.

Security risks

1DDoS amplification: IRC servers on ports 6660-6669 can be abused as DDoS reflectors – sending JOIN/WHO commands to a large channel generates substantial response traffic directed at spoofed source IPs. Channel user lists on large networks produce multi-kilobyte responses per small query.
2Botnet command-and-control: ports 6660-6669 are the classic IRC C2 range. Compromised machines connect to IRC channels on these ports to receive commands (DDoS targets, spam campaigns, cryptocurrency mining). Outbound connections to port 6660 from servers should trigger immediate investigation.
3Cleartext protocol: all messages, nicknames, channel topics, and NickServ passwords sent on port 6660 are visible to any network observer. MITM attacks trivially modify messages in transit or inject commands into established sessions.
4Obsolete port range: port 6660 exists primarily for legacy compatibility. Modern IRC deployments use port 6697 (TLS) exclusively. Traffic on port 6660 in a corporate network is more likely to indicate malware C2 than legitimate IRC usage.

Firewall guidance

Block outbound connections to ports 6660-6669 from all servers and workstations unless IRC usage is explicitly sanctioned. Monitor for unexpected outbound connections to this range – they frequently indicate botnet infection. If IRC is needed, allow only port 6697 (TLS) to specific whitelisted IRC network IPs.

Diagnosis commands

Check for active IRC connections on the 6660-6669 range (potential botnet indicator)

shell

ss -tnp | grep ':666[0-9]'

Scan for IRC servers in the standard range

shell

nmap -p 6660-6669 target

Quick connectivity test to IRC alternate port

shell

nc -z host 6660 && echo open || echo closed

Usage examples

Port 6660 – IRC (Alternate)

shell

irssi -c irc.libera.chat -p 6660
nc irc.server.com 6660
weechat -r '/connect irc.server.com/6660'

Common services on this port

UnrealIRCdInspIRCdircd-hybridCharybdisngIRCd

Related ports

6667

IRC standard port (plaintext)

6697

IRC over TLS (secure, RFC 7194)

6669

IRC alternate range end

History

IRC was created by Jarkko Oikarinen in 1988. The 6660-6669 port range became the standard IRC client connection range in the early 1990s when IRC networks began offering multiple ports for load distribution and firewall traversal. Port 6667 became the canonical default, with 6660-6666 and 6668-6669 as alternates. RFC 7194 (2014) formalized port 6697 as the TLS standard, beginning the deprecation of plaintext IRC ports.

FAQ

Should I block ports 6660-6669 on my network?

Yes for outbound traffic from servers and most workstations. IRC botnets have used this port range for C2 since the late 1990s. If developers need IRC access (Libera.Chat for open-source coordination), allow only port 6697 (TLS) to specific network IPs. Inbound 6660-6669 should be blocked unless you operate an IRC server.

Specification

RFC 2812 – Port 6660 specification →