This was the first time I managed to use the graph theory to spot the botnet traffic in the network. It used encrypted connections to the compromised WordPress sites for its command and control.