Are they sure its from Iran...

...and not someone using a proxy server to bounce off to make it look like its from another country?