Djinn Stealer C2 Exfil — HTTP POST to 96.126.130.126:58942 with telemetry-client UA

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects outbound network connections to a known Djinn Stealer C2 IP address (96.126.130.126) on port 58942, utilizing the specific User-Agent 'telemetry-client/1.0' and 'application/octet-stream' content type. This behavior is indicative of data exfiltration of encrypted/compressed archives.