The first vulnerability is owed to the exploitation of registrar servers. The registrar server is in charge for updating the location information of the UAs by handling REGISTER requests. A server answers to queries of UAs and discloses the location of registered users. Therefore, a SPITter can issue an attack to registrar in order to collect a set of URIs. This attack is success- fully accomplished because the user, who initiates a dialog to a registrar, is not compulsory registered or authenticated to a domain since the SIP specification does not oblige the domain to register each user. Thus, the impersonation of a legitimate user is easily acquired. The second vulnerability is the exploitation of particular domains' address resolution procedures. The SIP proxy servers and the afterward communication inherits the vulnerabilities which are intro- duced by the communication supplementary protocols, such as DNS queries, ARP, RARP, etc. These protocols can be vulnerable to several attacks, such as spoofing or man in the middle [8-10]. Therefore, a malicious intermediate could impersonate a legitimate user, spoof messages, deliver SPITs by using the victims' identities and create lists of other possible victims. 19.4 SPIT Identification Criteria A list of SPIT identification criteria are analyzed in this section. These may be applied as SPIT detection rules on both sides of a SIP communication and they can be proactive or reactive depending on the point they are applied (SPITter's or target's domain). We propose two generic categories of SPIT identification criteria: SIP Message criteria: This category includes the criteria that are related to attributes of SIP messages and they can be based on (a) call and message patterns or (b) headers' semantics. © 2009 by Taylor & Francis Group, LLC SIP Handbook: Services, Technologies, and Security SIP User Agent criteria: This category includes the criteria that are related to attributes of a SIP User Agent and they can examine the origin of the call or message as well as the