A good link, but unfortunatly not exhaustive! I would not base my sec policy on it ...

just an example: Evilbots & other IRC's that use port udp/6667 & udp/6668 to rcv/send info from/to the attacker.
These bots can be easily found in the net or be programmed. Sript kiddies love it...