the large cost of making international calls. This is one of the reasons why local "do not call lists", e.g., the U.S. national list of numbers that telemarketers cannot call, has been effective. This law only affects U.S. companies, but since most telemarketing calls are domestic, it has been effective. Unfortunately (and fortunately), the IP network provides no such boundaries, and calls to any VoIP destination are possible from any- where in the world. This will allow for international spam at a significantly reduced cost. International spam is likely to be even more annoying than national spam, since it may arrive in languages that the recipient does not even speak. VoIP has been already established in the communication world. While pre- viously it has been based on the H.323 [3] and the session initiation protocol (SIP) standard [4], the support for the former is decreasing [3]. As the new emerging IP telephony standard, SIP will certainly be the target of spam attacks. As a consequence, identifying SIP spam in advance and the mech- anisms to deal with, is a crucial task before the problem arises or becomes serious. The different forms of SIP spam can be categorized in the following way [5], Call spam: This is the case of unsolicited messages for establishing voice or video session. The spammer proceeds to relay his message over the real time media. This form is the usual method used by telemarketers. IM spam: This form is similar to e-mail spam, unsolicited IMs whose content contains the message that the spammer is seeking to convey. The SIP MESSAGE request will be used here but also some other messages such as INVITE with text or HTML bodies. © 2009 by Taylor & Francis Group, LLC A Conceptual Architecture for SPIT Mitigation Presence spam: Another form of spam similar to IM spam is called pres- ence spam. The latter is generated by unsolicited presence (subscribe) requests sent to get on the buddy list of a user and then IMs will be sent to this user or some other form of communications will be initiated. 