TrendLabs: DDoS Attacks and IoT Exploits: New Activity from Momentum Botnet

Figure 2. Command and control communication path (downloader/distributer server, IRC server)

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/ddos-attacks-and-iot-exploits-new-activity-from-momentum-botnet/