I hadn't used GTK for half a year (MacOSX version.) I opened it up & it connected to 4 other GTK hosts with port 59345. 3 of these would have been blocked via the Hostiles list used for BearShare & LW.
I upgraded to the MacOSX GTK 1.0.0 and noticed a GTK host being listed as hostile. After checking versions I read the other GTK hosts listed as being hostile is a bug. Any idea when the MacOSX update for 1.0.1 will be released?

I realise the update for Linux & Windows was only released 31 Dec.

The only GTK host it didn't list as being hostile was a 2007-07-07 version which coincidentally was using port 59345.
Dare I say it, my connection files I provide for Phex & LW both have 4 GTK hosts with this port & two of those I connected to. This now makes me somewhat suspicious of hosts with this port when 3 were from USA & two from Brazil. Just seems too coincidental to be trusted. Or is this a default port for GTK-Gnutella?

Port 27016 are spambots, and port 7001 upload-sucker bots. If port 59345 is also used by bots, I'd have no idea what their purpose is, unless someone can educate me.

Also upon quitting GTK, it crashed in the process.
Exception Type: EXC_BAD_ACCESS (SIGABRT)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000010
Crashed Thread: 0 Dispatch queue: com.apple.main-thread

Edit: 9+10 Jan 2014. Seems I found another two bots in the 50.58.238.x. range (this one is supposedly a static ip). I was listing all the hosts I was connecting to over a period of time. Seems a dozen & half of same ip address, just different port (between 6000-7000) but all LimeWire/4.12 (Pro), (no specific 4.12 sub-version, which suggests it is a fake ID, especially since LW 5 versions supposedly do not connect to versions below LW 4.14). I was connected to 4-7+ of these at a time whilst being a peer using LPE.
I'm aware GTK is not interested in bot listings to block, so I'll simply add it to the bot lists I've added to the BS & LW blocklists. I'm not 100% certain but seems same ip as the one that browsed me immediately I connected to the network, and same host address as did so on multiple occasions in early Jan & mid-late December. There was a previous individual listing in the hostiles for this /24 sub-range (which I added in 30 August 2012), which now makes 3.
Recorded as bot ip's.

. . .
Couple snaps joined, from 9th & 11th January.
I didn't keep a list of all these connections but of the 9 ports I saw used today varied between 6509-6599.

The evidence these are bad hosts via BearShare 5.1's console logs:

Peer in 50.58.238.243 ("LimeWire/4.12 (Pro)" 777 msgs) sending query with invalid address embedded in GUID field (192.168.1.123:7000).
Peer in 50.58.238.243 ("LimeWire/4.12 (Pro)" 620 msgs) sending query with invalid address embedded in GUID field (192.168.1.123:6561).
Peer in 50.58.238.243 ("LimeWire/4.12 (Pro)" 212 msgs) sending query with invalid address embedded in GUID field (192.168.1.123:6562).
Peer in 50.58.238.243 ("LimeWire/4.12 (Pro)" 624 msgs) sending query with invalid address embedded in GUID field (192.168.1.123:6518).
Peer in 50.58.238.243 ("LimeWire/4.12 (Pro)" 4 msgs) sending query with invalid address embedded in GUID field (192.168.1.123:6575).
Peer in 50.58.238.243 ("LimeWire/4.12 (Pro)" 544 msgs) sending query with invalid address embedded in GUID field (192.168.1.123:6564).

(small attached image to the left)

I connected to multitudes of them. Not forgetting their id must be fake because LW 5 versions do not connect to versions older than LW 4.14, which happened on several days prior to today.
The above constant messages stopped after I added the block of the address to the hostiles & restarted BearShare. (twice)

Edit: 16 January: 50.58.238.131 with identical port ranges is still active (added in 2012.)

No, there is no default port, they are (should be) randomly chosen on the first startup.

Normally OSX versions are released within a couple of days after the source release.
Version 1.0.1 for OS X was released january 6, as you probably already have noticed.

__________________
Spam goes to [email]ben@asselman.com[email] (no don't mail there, it will be treated as spam).

One of these appears to be a bot that browses when you first join the network. I believe I did at one time put it onto the hostiles but then removed it last year or earlier.
It connected to me as a UP whilst i was an LPE UP but my MacOX Console log only shows one connection attempt, despite LW showing that it browsed me also. Unless early GTK versions had an effect of auto-browsing hosts when they connected to them?
I'd have thought a browse host request would come in a separate message. Unless both (connect & browse) sent within same packet(s) of information or continuation of a single message?
#.#12.208.195:59345 gtk-gnutella/0.96.4-14059 (2007-07-07; GTK2; Linux x86_64)
LPE pseudo ID: indigoSnip-208-195
It appears to be a 24/7 UP. Of course I have it on my connection lists for LW/Phex/BS, etc. but wondering if that's a bad idea.

Edit: I'll start a new thread, since this is really off-topic.