Is Турбо Ютуб – Смотри ютуб без замедления safe?

High risk

Турбо Ютуб is high risk. Installing this extension routes YouTube traffic through a third-party SOCKS5 proxy at 194.62.105.246:3455. The operator can see every video request, video ID, search query, comment, and auth cookie sent. The listing calls it a speed tool.…

75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

YouTube Traffic Routed Through Undisclosed Third-Party SOCKS5 Proxy on Install

Installing this extension routes YouTube traffic through a third-party SOCKS5 proxy at 194.62.105.246:3455.

The operator can see every video request, video ID, search query, comment, and auth cookie sent.

The listing calls it a speed tool.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install the extension.

No further interaction is required, the proxy activates automatically within 300 ms.

The extension did this

The extension routes all YouTube traffic through a third-party SOCKS5 proxy at 194.62.105.246:3455.

This includes video requests, thumbnails, search queries, comments, and any authentication cookies attached to youtube.com requests.

02EvidenceCODE COMPARE
The code that does this

PAC script hard-coded in background.js (lines 90-149)

What it actually does
// The PAC script routes 27 YouTube-related domains through a single hardcoded
// SOCKS5 proxy address. No user setting controls which proxy is used.
// The proxy address is not disclosed in the Chrome Web Store listing.
//
// Domains matched (excerpt): youtube.com, *.youtube.com, googlevideo.com,
// *.googlevideo.com, ytimg.com, youtu.be, youtubei.googleapis.com,
// yt3.ggpht.com, youtube-nocookie.com, youtubekids.com, gvt1.com ...
//
// Return value: "SOCKS5 194.62.105.246:3455" for all matched domains;
// "DIRECT" for everything else.
03EvidenceTHIRD PARTY LIST
Proxy destination
  • 194.62.105.246

    SOCKS5 proxy server (port 3455). All YouTube-domain traffic passes through this host. Ownership and operator identity are not disclosed in the extension listing or privacy policy.

04EvidenceFIELD TABLE
Data observable by proxy operator
FieldValueWhy it matters
Full request URL
https://www.youtube.com/watch?v=dQw4w9WgXcQEvery YouTube URL you visit, including video IDs and search terms embedded in the path.
Viewing history
GET /watch?v=abc123 at 14:02:11, /watch?v=xyz789 at 14:31:44The sequence and timing of every video you watch can be reconstructed from request logs at the proxy.
YouTube authentication cookies
VISITOR_INFO1_LIVE=...; SID=...; SSID=...Cookies attached to youtube.com requests, including session tokens, travel through the SOCKS5 proxy and are visible to the proxy operator.
Video CDN requests
https://rr3---sn-h5q7kn7y.googlevideo.com/videoplayback?id=...Requests to googlevideo.com and gvt1.com that deliver video content reveal which videos you stream.
SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

YouTube Proxy Activates Automatically on Install With No User Consent Step

The extension defaults its proxy to 'connected' on first launch.

Within 300ms of install, YouTube traffic routes through the SOCKS5 proxy at 194.62.105.246:3455.

The welcome page discloses no proxy, offering only a Telegram invite.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install the extension.

The Chrome Web Store install button is the only action required.

The extension did this

The proxy activates automatically within 300 milliseconds, before any settings or disclosure are shown to the user.

initProxy() runs automatically, defaults targetState to 'connected', and calls enableProxy() via a 300 ms timer.

02EvidenceCODE COMPARE
The code that does this

initProxy() defaults to 'connected' without user input (background.js lines 45-61)

What it actually does
// On first install, targetState is undefined (never been set).
// The function immediately writes 'connected' as the default —
// no prompt, no checkbox, no user interaction of any kind.
// 300 ms later, the proxy is live and routing YouTube traffic.
//
// initializationDelay = 300 (ms), defined at module top level.
03EvidenceSTORAGE DUMP
What's stored on your device

Captured before any user interaction. connectionCount=2 shows the proxy connected twice at startup; no click was required.

Locationchrome.storage.local immediately after install
Contents (JSON)
{
  "targetState": "connected",
  "currentState": "connected",
  "connectionCount": 2
}
Updated 17 September 2026gkdbmbhmlcjmoloamkobhfhmbmmpefjp