Botnet detection identifies local proxy as C&C server