d in conjunction with sending ambiguous requests to proxies (first vulnerability). Throwaway SIP accounts. The creation of many accounts in various domains, by the same user, can prove to be a great vulnerability which can be exploited by SPITters. This is because the SPIT traffic can not be easily associated with a specific SIP account, using conventional anti-SPIT counter- measures, such as Black Lists. This vulnerability is due to the SIP specifica- tion [7] which clearly states that a user can be registered in a SIP domain by simply sending a REGISTER message. Thus, a SPITter is free to issue multiple REGISTER messages and as result to create multiple accounts in a SIP domain. Misuse of stateless servers. Open Relay Servers, which exist in the email domain, are used by spammers to forward their spam emails. The SIP specifi- cation states that there can be stateless servers which offer the same service as Open Relay Servers in that they forward any call to its destination. SPITters can exploit it for hiding their IP address and location. Stateless proxies are not frequently used by SIP domains but are useful because they easily handle the rare flood of request messages. C 2009 by Taylor & Francis Group, LLC SIP Vulnerabilities for SPIT, SPIT Identification Criteria Anonymous SIP service and Back-to-Back User Agents. The anony- mous SIP option permits the forwarding of any call to a recipient without disclosing the caller identity. SPITters use this option to overcome various detection methods, such Black Lists and header content analysis. In this sce- nario a Back-To-Back User Agent (B2BUA) acts as a concatenated User Agent Server (UAS) and User Agent Client (UAC) [7]. The B2BUA collects and parses every request of a dialog [7]. Thus, a SPITter can replace the contact information of every message with its own before forwarding the message. The recipient upon answering to his request would engage in a malicious dialog. Sending messages to multicast addresses. The via header is one of the most important SIP head