It's because they typically hack web servers, and then they spawn a fresh web server on a random port. Anything below 1024 requires root access, which can be p

It's because they typically hack web servers, and then they spawn a fresh web server on a random port. Anything below 1024 requires root access, which can be problematic, and 80/443 may already be used.