ng conclusion section. 19.2 Background 19.2.1 SPIT Definitions Spam over Internet Telephony is defined as a set of bulk, unsolicited calls or instant messages. A SPITter uses the existing IP infrastructure to target users, C 2009 by Taylor & Francis Group, LLC SIP Handbook: Services, Technologies, and Security in order to initiate SIP calls or send SIP instant messages and generate spam. The phenomenon is already known from both the e-mail and the traditional telephony context. SPIT can be identified in three different forms: a) Call SPIT, which is defined as bulk, unsolicited session initiation attempts in order to establish a multimedia session. b) Instant Message SPIT, which is defined as bulk, unsolicited instant mes- sages and it is known as SPIM (spam over Instant Messages). c) Presence SPIT, which is defined as bulk, unsolicited presence requests SO that the malicious user becomes a member of the address book of another user or potentially of multiples users. SPIT is a relative new identified threat; some first SPIT messages have been reported but the phenomenon has not yet reached the massive volume of the e-mail spam. The two types of spam (e-mail spam and SPIT) illustrate several common characteristics, like the use of the IP protocol to send e-mails and initiate calls or IMs, respectively. Attacks that are common in the e-mail con- text are applicable and expected to be seen in the SIP context too. Examples include harvesting addresses, dictionary attacks, zombies or bots. 19.2.2 Motivation Despite the similarities that one can observe on the two spam types, there are also elements that differentiate the threats and vulnerabilities and justify the need for discovering new countermeasures to mitigate SPIT or adopt existing techniques cautiously. Firstly, SIP communication is not asynchronous as the e-mail one. An SIP call is held in real time and is sensitive to delays. Only at the call establishment phase some delay may be accepted and this ren- ders the application of existing content analysis techniq