BitTorrent IP is out, under Services: every IPv4 and IPv6 address where a BitTorrent client was seen in the last 90 days, a row per address, rebuilt daily. A row says when clients were seen there, how many shared the address at once and which client software they identify as. It never says what an address shared or downloaded.
One address per row
Five rows from the sample, as the first build had them, on October 20:
| Address | Verified | Last reachable | Ports | Peak ports | Indexer | Clients |
|---|---|---|---|---|---|---|
185.159.157.76 | true | 2026-10-20 | 38 | 38 | false | LT |
5.181.233.122 | false | 11 | 11 | false | ||
2602:fdb8:131:c001::7:1 | true | 2026-10-20 | 30 | 30 | false | LT |
148.113.176.70 | true | 2026-10-20 | 1 | 1 | false | LT |
147.135.11.133 | true | 278 | 278 | true |
verified is true where a client at the address answered directly, or two or more other clients reported it at the same time, and last_reachable is the last day one answered directly. An address only one client reported stays in the file with verified false, and most of those are clients behind NAT, which can't be reached from outside. 5.181.233.122, a FastestVPN exit, was one on October 20 and has been verified since.
Ports is num_ports, the ports clients used at the address in the window, and Peak ports is peak_num_ports, the most on one day: about how many clients shared the address at once. 38 shared 185.159.157.76, a Proton VPN exit, and one ran on 148.113.176.70. indexer marks an address that indexes the BitTorrent network rather than downloading from it, as 147.135.11.133 does. clients holds the codes clients identify themselves by: LT is libtorrent, which qBittorrent and Deluge run on, and UT is µTorrent. first_seen, last_seen and days_seen give the first and last day a client was seen there, and on how many days.
In the October 27 build
The October 27 build holds 23,253,076 addresses, 12,732,527 IPv4 and 10,520,549 IPv6, and 54.0% of them are verified. Its first day is October 20, so the 90-day window holds eight days so far. 72.0% of the addresses were seen on one day only: 86.3% of the IPv6 ones and 60.2% of IPv4.
A client answered directly at 8,186,099 addresses. 73.7% of them run libtorrent and 14.3% µTorrent, and 4.8% send no code.
The IPv4 addresses by country, from IP Country:
| Country | IPv4 addresses |
|---|---|
| China | 2,405,411 (18.9%) |
| Russia | 2,210,936 (17.4%) |
| India | 799,933 (6.3%) |
| Brazil | 595,472 (4.7%) |
| United States | 472,008 (3.7%) |
| South Korea | 436,197 (3.4%) |
Shared addresses and VPN exits
90.4% of the addresses never had more than one port on a day. 442,226 had three or more on one day, as a VPN exit, a proxy or a carrier's NAT does, and 36.5% of the IPv4 ones are in Russia.
383,740 of the IPv4 addresses, 3.0%, are in VPN IP's ranges, and 43.2% of those are verified, against 51.5% of all IPv4. The share depends on the VPN:
| VPN | BitTorrent addresses verified |
|---|---|
| NordVPN | 7.5% |
| CyberGhost | 26.2% |
| ExpressVPN | 38.0% |
| Mullvad | 41.1% |
| Surfshark | 65.4% |
| Private Internet Access | 66.7% |
| Proton VPN | 83.9% |
A filter on verified would drop 92.5% of the BitTorrent addresses in NordVPN's ranges, so every row ships, with the flag beside it.
Getting access
BitTorrent IP ships as CSV, rebuilt daily, and its docs page has the schema. Sign up to evaluate it from its sample. A license is per database and never metered: see licensing, or talk to us about what you need. With a license, it's in BigQuery too.
