# Why Malwarebytes communicates to your Mullvad

**URL:** https://discuss.privacyguides.net/t/why-malwarebytes-communicates-to-your-mullvad/20823
**Category:** General
**Tags:** software
**Created:** 2024-09-12T04:40:22Z
**Posts:** 5

## Post 1 by @anon23293884 — 2024-09-12T04:40:22Z

If you have **Malwarebytes** , check your version number.

> **disclaimer**
>
> Everyone has their own opinion, however, this is an official partner of **Mullvad** , I assume the **Mullvad** team is smart about the brands they productively partner with.

**Malwarebytes** for **Windows** communicates with a server in Sweden  
`host.ipv4.am.i.mullvad.net`

During my exploration of **Lulu** alternatives such as **Little Snitch**  
(thanks to the creator of [this thread](https://discuss.privacyguides.net/t/little-snitch-software-firewall/18485), yesterday I decided to get to know about that product in practice)

I found that the **MacOS** version (5.4.1) does the same thing.

What could this be related to?

The first thing that comes to mind:

 ![Screenshot 2024-09-12 at 06.48.42](//forum-uploads.privacyguidesusercontent.com/original/2X/7/70d8090b20f0d36a994fef260c464535bee2ef73.png)  
[_source_](https://mullvad.net/en/help/partnerships-and-resellers)

I was able to stop the connections using a firewall.

But what should I do if using a firewall is not an option?

> Users **do not** have this latest version of **Malwarebytes** installed by auto-updates

First of all, let me know if this topic was useful for you, it motivates me to continue or try other formats.

_Poll: Poll (view on site)_

And now the main thing:

* * *

2 options if you are using Malwarebytes and do not have a firewall that can suppress unnecessary connections caused by the bug.  
(add more options, I would be glad, юмор приветствуется)

1. If you manually [download](https://www.malwarebytes.com/mac-download) and install the latest version 5.5.3 the connections stop

2. additionally try this option,  
check for updates manually by going to Malwarebytes menu → Check for updates.

It may be necessary to make a check in the settings that you are interested in demo versions, but let me remind you that  
`knowledge on PG helped me realize the importance of stable versions`

I suggest you consider solutions that include manual management of Internet traffic.

---

## Post 2 by @ph00lt0 — 2024-09-12T06:43:16Z

This is most likely due to that the “Privacy VPN” of malwarebytes is using Mullvad servers.

Generally speaking i would not recommend to use any AV on windows other than Defender/Windows Security.

---

## Post 3 by @anon23293884 — 2024-09-12T07:57:22Z

> [@ph00lt0](#):
>
> This is most likely due to that the “Privacy VPN” of malwarebytes is using Mullvad servers.

This is definitely due

> A **software bug**

**Aryna** , from Malwarebytes staff confirmed.

 ![Screenshot 2024-09-12 at 10.53.55](//forum-uploads.privacyguidesusercontent.com/original/2X/8/8f810aa114d1769f95554f51034e242b98b248bd.png)

**Even if you bought a license without VPN and Malwarebutes VPN is disabled, connections still happen.**

Additionally, I found incoming connections wrom the same IP address to the device (ICMP protocol)

from:

**Mullvad Daemon** with **root** privileges.

**macOS wifivelocityd**

**why**?!

> **probably for this reason**
>
> “wifivelocityd” is part of the macOS WiFiVelocity framework. It is responsible for collecting statistics of the WiFi network quality. This process may contact your router and Apple servers, probably in order to determine over-all network throughput or latency.

---

## Post 4 by @anon23293884 — 2024-09-12T08:22:34Z

For all those who stick to the gradations of [Common Threats](https://www.privacyguides.org/en/basics/common-threats/)

I would like to remind you that there are threat models like:

 ![Screenshot 2024-09-12 at 11.15.14](//forum-uploads.privacyguidesusercontent.com/original/2X/6/6d4561acac323cf4c37f258abfd21574c2ceb31d.png)

the **server** to which they connect is in **Malmo**.

 ![Screenshot 2024-09-12 at 11.09.00](//forum-uploads.privacyguidesusercontent.com/original/2X/2/2ef8e8ebbfff24214cf53666520ce0eda2c16df5.png)  
 ![Screenshot 2024-09-12 at 11.46.04](//forum-uploads.privacyguidesusercontent.com/original/2X/7/738391a8698bdcde34f9e6f5468de0ee2835061f.png)

according to information from [browser leaks](https://browserleaks.com)

 ![Screenshot 2024-09-12 at 11.19.41](//forum-uploads.privacyguidesusercontent.com/original/2X/b/b4d9e851ca158fc989132feaa2f5a0617f1574b5.png)

---

## Post 5 by @securitybrahh — 2024-09-12T08:57:04Z

good Find!