The ports it opens are a function of your IP address, so you cannot just look for port xyz traffic, but a remote conficker can figure out which ports should be open for your IP. It does updates with a plain URL that no IDS could catch without red flagging genuine HTTP requests.