Why does qBittorrent make connections to random IPs when there is no torrent activity?

[Jakobud]

I saw this question posted on Reddit recently and then I noticed similar behavior.

I'm running Malwarebytes Antimalware in Windows 10. Yes I know that antivirus programs are a little bit too eager to make Torrent clients as dangerous. But this is something different.

Currently I have qBittorrent running. There are no torrents being uploaded/downloaded/seeded/etc. No torrents listed in the interface. No torrent activity.

Yet, Malwarebytes keeps giving me popup warnings like this:

It is detecting qBittorrent making outgoing connections to unknown "random" IP addresses. Normally, if I was uploading/downloading torrent data I would expect this. But in this case, there is zero torrent activity. Yet the program is still making these seemingly random connections.

What is the reason for these connections? Why is qBittorrent making these connections? Is any type of data being sent to these connections? If so, what kind of data?

The IP addresses are never the same and the port seems to always be random.

If one was to install a data monitor like Wireshark would they be seeing qbittorrent sending packets to these IPs?

[Jakobud]

After some investigation is this because of the Distributed Hash Table? I notice there are DHT connections in the statusbar even when no torrent activity happening.

[thalieht]

is this because of the Distributed Hash Table?

Probably. Turn off DHT and find out.