From none, on this machine is only the windows defender installed on some messages its pretend to be avira, messages like avaria found 5 critical viruses, but you can see that the notification origins from firefox

I think it is take messages from brnok.axegrinder.top website, but we dont open that or other suspicious sites.

Looks like fake messages pretending to be from the Firefox web browser which does not have any antivirus type of scanner feature built in Firefox on Windows, macOS, or Linux. Could be some form of malvertising as this was a culprit when there was fake Firefox updates going on (Chrome/Chromium users got the same sort of fake updates then also)

The brnok.axegrinder.top site you mentioned was suspended.

https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-caused-malware https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work

How can I determine the source ?

It is difficult to trace back the source, but similar messages have in the past been due to malicious adverts in web pages.

The links that James mentions above are good sources of support for this issue.