Torrent Intelligence
Torrent Intelligence tracks monitored torrent publications connected to leak-site events and records peer observations where available.
What the Overview Shows
Section titled “What the Overview Shows”The overview summarizes:
- monitored events with torrent coverage
- events where peers have been observed
- unique peer IPs
- recurring seeder IPs seen across events or leak sites
Use the overview to spot repeated infrastructure, active torrent distributions, and events with meaningful peer activity.
Search and Pivoting
Section titled “Search and Pivoting”The torrent search field accepts:
- event IDs
- victim or claim names
- leak-site names
- IP addresses
- countries
- BitTorrent client software
Search results can lead to an event view or an IP view.
Event View
Section titled “Event View”The event view focuses on one monitored torrent event and can show:
- monitoring status
- observed runs
- peer and seeder counts
- last-seen timestamps
- uploaded byte totals
- peer countries and client software
- parsed torrent metadata and file lists
- related events sharing observed infrastructure
IP View
Section titled “IP View”The IP view is useful for recurring infrastructure analysis. It groups observations for a single peer IP across events and leak sites and highlights seeder activity, repeated sightings, countries, client software, and recent activity.
Status Terms
Section titled “Status Terms”- Active means recent monitoring still observes relevant torrent activity.
- Offline means the event has torrent metadata but no current peer activity.
- Inactive means the event is no longer actively monitored or has no useful current signal.
The monitoring infrastructure IP is excluded from normal peer reporting so counts focus on observed third-party peers.