er fields. The content of the via field shows the route that should be followed by the response message and the path the request has followed towards the target UA. The Maddr tag is a possible property of this specific field and indicates a multicast address. A SPITter who obtains such an address is able to initiate calls to a set of users belonging to the multicast address. Exploitation of forking proxies. A forking proxy server is a SIP proxy server which can send an INVITE message to multiple recipients simulta- neously. These kinds of servers help SPITters to collect a list of active SIP URI's faster, by using the vulnerability of sending ambiguous requests, which might result in a return of unambiguous new addresses. After a SPITter sends an ambiguous INVITE request, it can initiate simultaneous calls towards all the addresses returned by the location service. In this case it is obvious that a SPITter using one single request can automate bulk SIP calls generation utilizing a statefull proxy. Exploitation of messages and header fields structure. A way of sending SPIT is through bulk unsolicited messages. Actually this could be achieved by (a) using the MESSAGE method, or (b) hiding the message in various SIP header fields of the SIP protocol message bodies. A SPITter is capable of sending a SIP message, initiating a request, or spoofing the SIP responses transferred in the network. A request message might use the INVITE and the ACK methods, which both include a message body, which in turn might convey SPIT traffic. This body might include any media file that eventually will be delivered to the recipient. Furthermore, the MESSAGE method can be used to encapsulate SPIT traffic. This option might exploit the fact that any SIP flow outside a dialog does not require the authentication of the caller UA. On the other hand, the response messages include data fields that can be manipulated by a SPITter. Table 19.1 illustrates the main response messages that can be used for SPIT content encapsulation: Finally both req