How is it possible for Malwarebytes to detect actual ID while using Mullvad VPN?

I downloaded Malwarebytes for some virus scan earlier today and noticed that despite I have Mullvad VPN on, Malwarebytes is detecting the actual server location as well as my Actual IP address.

Has anyone had this experience?

I’ve not used Malwarebytes in ages but I guess it’s just looking at your network interfaces? Same way how qbittorrent has to be forced to use the VPN network interface otherwise your real IP will leak alongside the VPN one.

Not sure what you mean by “detecting the actual server” but Malwarebytes’ VPN is reskinned mullvad. They’re partnered with mullvad and use mullvad’s infrastructure to provide the VPN service just like Mozilla VPN.

That screenshot is from the Malwarebytes application that is installed on your system, right? If so, then it’s expected behavior when it detects your ISP-issued IP address, since antivirus programs see network sockets (it’s how they’re able to scan oncoming files).

If you’re wondering why Malwarebytes knows your VPN IP belongs to Mullvad, see here; Why Malwarebytes communicates to your Mullvad - Privacy - Privacy Guides Community

You are running 2 vpn’s? Are you also running 2 firewalls and antivirus? Ever since the internet was created, that is a no no. Stick to one product in each category.

Cached data from when the vpn was down?

Malwarebytes seems to be getting around the VPN or maybe finding your real IP address through a DNS leak or a setup error. You could check your DNS settings or do a DNS leak test to find out if your real IP address is being shared. You could also try getting help from Mullvad’s support team.

Have gps services enabled perhaps?

I’m not running 2 vpns, but only 1 vpn which is mullvad. I downloaded malwarebytes one time just to check for any virus and was suprised to see this.