That is a message from the server and not Thunderbird. That IP address is in New Jersey, USA I checked with Spamhaus and it says: https://check.spamhaus.org/results?query=161.178.137.204 ''Date Listed: October 29, 2025 04:15:53'' ''Date Removed: November 11, 2025 03:45:31'' ''Why was this IP listed?'' ''A device using 161.178.137.204 is infected with malware:'' ''161.178.137.204 initiated a connection to a corebot command and control server, with contents unique to corebot C&C command protocols.'' ''Technical details of the corebot detection'' ''161.178.137.204 initiated a tcp connection from 161.178.137.204 using source port 51585, to the sinkhole IP address 216.218.185.162 on destination port 80.'' ''The most recent detection was on: October 27 2025, 23:07:20 UTC.'' Do you have a '''VPN''' enabled on the computer ? It's worth checking out because some Anti-Virus products now include a VPN and I've discovered there are occasions when user did not realise it was enabled. Switch VPN off. Servers do not like VPN as it attempts to hide your Ip address, so server thinks you might be hacker and blocks access. Important - check computer: Restart computer in 'Safe Mode' Run a full scan.