or & Francis Group, LLC SIP Handbook: Services, Technologies, and Security Listening to a multicast address. Every participant in an SIP session needs to be aware of the current location of other UAs. The physical location and the IP address of a user are discovered during the session initiation phase. In this phase, the proxy servers answers user or server REGISTER requests by consulting the location service. In order for the location service to have a valid URI database, it should be aware of any user change of address. This is achieved by listening to a specific multicast address where the UAs send a REGISTER message which contains their current IP addresses. The UAs listening to that address are therefore informed of users' location. On the other hand, if a SPITter is listening to that multicast address, he is in the position to assemble both a set of the addresses of the registered users and their registration. Population of "active" addresses. Registration is a main function in the SIP infrastructure. The registration is accomplished when the REGISTER messages link the user's URI with the machine it currently uses and the IP address it happens to be using at that exact point in time. Therefore, both of the aforementioned weaknesses combined facilitate the determination of online users by SPITters. This vulnerability allows SPITters to send a smaller amount of SPIT messages and a larger number of successful SPIT since it can forward messages to users that are currently logged on. Contacting a redirect server with ambiguous requests. As proxy servers can handle a great amount of messages; redirect servers are employed to bal- ance the load of proxy servers. A redirect server is designed to refuse any other request than CANCEL. But it can collect a possible list of alternative locations of UAs and forward it to the requestor. The SPITter can therefore send ran- dom requests to redirect servers and as a result collect a list of URIs in order to send SPIT messages. This attack could be more effective if conducte