indicators

Cybersecurity specialists often encounter torrent traffic during investigations into corporate policy violations and criminal activities. A study proposes that torrent metadata can serve as a source of open-source intelligence, focusing on the valuable information that can be extracted from publicly available torrent metadata. Torrent files contain descriptive information such as file names, tracker addresses, cryptographic hashes, and various metadata fields. Trackers provide lists of peers connected to specific files, revealing IP addresses and ports, which can be used for security analysis. The research collected metadata from The Pirate Bay and public UDP trackers across 206 popular torrent resources, resulting in a dataset of over 60,000 unique IP addresses. These addresses were enriched with data on geolocation, internet service providers, autonomous systems, and indicators of VPN or hosting infrastructure usage. A specific analysis phase labeled IP addresses linked to child sexual exploitation materials using an external monitoring database, without direct interaction with illegal content. Co-author Giuseppe Cascavilla noted that the choice of UDP trackers was intentional, allowing for testing the analysis concept while limiting observation completeness. He suggested that expanding the methodology to include large-scale data collection from DHT networks could improve coverage and identify users avoiding centralized trackers, potentially revealing correlations between anonymization and riskier behavior. The findings are presented as a conservative snapshot of activity observable through open tracking mechanisms.