Censys recently released the Universal Internet Dataset, which increases the number of ports scanned from 40 to 1045. This port coverage expansion provided far more visibility into the less visited areas of the internet. The services running on port 443, 80, and 21 provide valuable information, but are much more sterile compared to some of what we find on ports such as 5357 or 10554.
Scanning for 25x more ports gives us a lot more interesting data, including giving us about 20x more visibility into IPs with torrenting services exposed. Specifically, we measured the distribution of IPs that were visible in the Standard Deep Scan Dataset (40 ports) compared to the IPs that were visible in the Universal Internet Dataset (1000+ ports) for more than eight common torrenting services.
From our vantage, uTorrent (a proprietary software developed by BitTorrent) is the most commonly seen service, followed by Vuze, BigBT, and Transmission. This is based on client responses, not on traffic or the popularity of software downloads, giving another data point about the P2P community.
Many of the Torrent clients authenticate over basic access authentication headers, which help expose the service running. It was common to see more than one port on an IP running a torrenting service. Below are examples of some of the banners returned by these services which are available to explore with the Universal Internet Dataset.
Censys collects and parses TLS certificates during its scans, which helps us identify more about hosts than just the IP address alone. Many of these torrenting services did not present TLS certificates. However, there were some standout trends among those that did: 33% of the IPs with a TLS certificate running torrenting clients had a Seedbox name on the certificate. Seedbox is a Peer-to-Peer (P2P) service that leverages BitTorrent for the uploading and downloading of digital files.
If you’re looking to explore more data like this, request a demo to find out how you can start searching across this dataset today.
