i recently came up with this message when tried to run tor while vpn was running as well.
The log you're showing can be MitM - and there's how to check it:
- make a
suto your Tor user
- do a traceroute to the 18.104.22.168 - or also to other IP's that are mentioned in that
If the trace(s) completes OK - then it is a MitM proven. If it's not - do
netstat -r and examine your routing table: many VPN's are setting itself as a default router, so it can be either a "route table switch" moment, but it should repair itself in time, or you may have a routing issue. Yes, some VPN's - especially in Russia - did the MitM attempt when using Tor through them when it was not violating their ToS. So the outcome of your test will show the truth.