You're wrong on this one. The IP address has nothing to do with it. The worm is sent as an attachment to email.