Turbo VPN Showed 'Connected' While Your Real IP Stayed Visible
Turbo VPN's Windows client reported an active connection while the user's real IPv4 address stayed visible. TechRadar published the finding this week, and it took the company two patches to stop the leaks: the emergency build, version 3.7.0.0, arrived only after researchers sent a second set of technical evidence. The dangerous part is that nothing looked wrong. The app said connected, and there was no reason to doubt it.
The app was not building a tunnel at all
The most useful detail is not that something leaked, but why. Turbo VPN's proprietary Lepus protocol did not create a system-wide encrypted tunnel the way a VPN normally does. Instead it launched a local ShadowsocksR process on the machine, switched on the Windows proxy setting, and ran a proxy on port 46288.
That distinction decides what is protected. A proxy configured in Windows settings catches applications that respect that setting, which mostly means browsers. Everything else keeps using the ordinary connection: background operating system traffic, desktop messaging clients, update services, command-line tools. The interface still says connected, because from the app's point of view the proxy is up. The user sees a green state and assumes it covers the machine.
It took two patches to close
After the first report, Turbo VPN issued a fix. It was not enough. Version 3.6.0.0 continued to leak IPv6 addresses, and not only on the proprietary protocols Lepus and LinkSentinel but on standard OpenVPN connections as well. Only after further technical evidence did version 3.7.0.0 arrive, blocking unencrypted IPv6 at the client and forcing traffic down the encrypted IPv4 tunnel. Testing confirmed that this build holds.
Worth keeping the scope straight: the leaks described here were found in the Windows client. That is not a reason to relax about the mobile apps, but it is what was tested and reported.
This was not the first warning about these apps
The design makes more sense against the background. In 2025, Citizen Lab published research at FOCI on what it called hidden links between VPN apps. Eight applications distributed by Innovative Connecting, Autumn Breeze and Lemon Clove, including Turbo VPN, Snap VPN and VPN Proxy Master, with more than 380 million downloads between them, were found to share code, dependencies and a hardcoded Shadowsocks password. A shared hardcoded password means anyone who extracts it can decrypt the traffic it is supposed to protect.
The same research reported deprecated encryption ciphers, undisclosed collection of location data, susceptibility to packet injection, obfuscated code that resists analysis, and ownership ties among the three firms to Qihoo 360, a Chinese cybersecurity company the United States sanctioned in 2020. It also made a point that explains the architecture: these are application-layer services built on Shadowsocks, a protocol designed to get through the Great Firewall, not to provide privacy.
How to check your own VPN in five minutes
This applies to any provider, including good ones. Connect first, then check:
- Open a leak test page and confirm the IPv4 address shown is the server's, not yours.
- Check IPv6 on the same page. IPv6 leaks are the most common failure, because many clients tunnel IPv4 and quietly ignore IPv6.
- Check the DNS servers listed. If they belong to your home provider, your browsing is visible to them regardless of the tunnel.
- Test non-browser traffic. Ping or run a trace from a terminal and see whether it exits through the tunnel. This is exactly what a proxy-only setup fails.
- Cut the tunnel while a download runs. If the download keeps going, there is no working kill switch, and every future disconnect will expose you.
Which is the practical case for choosing a provider that can be checked rather than one that is merely popular. What separates a serious service is not its install count, it is whether the protocol is documented, whether independent auditors have been let in and their reports published, whether leak protection and a kill switch are on by default, and whether the ownership is stated plainly instead of assembled from corporate filings. A free app with hundreds of millions of installs can still be a browser proxy with a shared password. We looked at a related failure when WebKit leaked real IP and DNS around proxies, and at the gap between promises and practice when a no-logs VPN leaked 58 million connection records.
