Two-thirds of online attacks that use some form of bait will this year originate from 500 known malware delivery networks. Malnet operators typically make money by selling a pay-per-install service, whereby customers pay them to infect PCs with malware. Blue Coat report recommends keeping a close eye on access to known bad websites and blocking access to proxy websites. The report also recommends blocking all non-SSL traffic that attempts to communicate via port 443. To avoid detection, many bots use encryption over port 443 for communications to command and control servers.”]
Source: https://www.darkreading.com/attacks-breaches/500-malware-networks-available-to-launch-attacks