Regularly reversing malware samples, we still see many malware getting their respective remote IP from remote services. This is even used by some recent malware to update the bootstrap DHT with their own IP... In such case, they don't even need to contact directly the C&C.

I don't get why my previous comment is down-voted ;-)