Unless the box that runs CF also serves as a web server, I nominate port 443 (SSL). I suspect that outbound connections to 443 would raise less suspicion in a corporate environment than outbound connections to port 23. Could also use 80, but I'm guessing traffic to 80 would be more likely to get inspected since it's sent in the clear.