I scanned a couple of IPs and I saw that they had opened port 6881 which is know for DHT node.
Couple of minutes later I re-scanned those IPs and find that there are less IPs with port(6881) opened as before so that got me thinking, how to check and be sure if port 6881 is used only for hosting DHT node and not for something else ?
Send a DHT ping message to that port and see if you receive a reply. Note that this will only positively identify that a DHT node is running on that port, it will not rule out other protocols multiplexed on the same port. In principle infinitely many different protocols could share a port as long as they are distinguishable in some way. In practice it would be likely that a bittorrent client is also listening for µTP packets on the same port.