Received: from 80.24.76.216 (HELO capu-a4nupkiokh) (80.24.76.216)
esa ip es de telefonica, es decir ese mail ha salido de una conexion con telefonica ( es decir, de un usuario de telefonica infectado con ese virus ke tenia esa direccion en su listado de direcciones de correo )
whois 80.24.76.216 | more
% This is the RIPE Whois server.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See www.ripe.net/ripencc/pub-services/db/copyright.html
inetnum: 80.24.0.0 - 80.24.255.255
netname: RIMA
descr: Telefonica de Espana SAU
descr: Red de servicios IP
descr: Spain
country: ES
admin-c: AFG2-RIPE
admin-c: JB986-RIPE
tech-c: FLT14-RIPE
status: ASSIGNED PA
remarks: ***************************************************
remarks: For ABUSE/SPAM/INTRUSION issues
remarks: PLEASE CONTACT THROUGH LINK
remarks: www.telefonicaonline.com/nemesys/
remarks: or send mail to nemesys@telefonica.es
remarks: any mail to adminis.ripe@telefonica.es will be ignored
remarks: ***************************************************
notify: adminis.ripe@telefonica.es
mnt-by: MAINT-TdE
changed: adminis.ripe@telefonica.es 20030923
source: RIPE
route: 80.24.64.0/18
descr: Telefonica Data Espan~a
origin: AS3352
mnt-by: MAINT-AS3352
mnt-routes: MAINT-AS3352
mnt-lower: MAINT-AS3352
changed: administracion.ripe@telefonica-data.com 20010717
changed: administracion.ripe@telefonica-data.com 20020118
changed: administracion.ripe@telefonica-data.com 20020313
source: RIPE