Is this really that uncommon? I thought botnets took advantage of compromised machines to perform TCP connections. Otherwise attacking a website would be "trivially" prevented by larger connections.