An Internet Service Provider (ISP) node is configured to suppress malicious session initiation protocol (SIP) messages. The ISP node is coupled to receive a new session initiation protocol (SIP) message from a user agent client associated with the ISP. If the SIP message includes a resource priority header (RPH) indicating the new SIP message should be given priority within the network, the ISP node determines whether the user agent client previously sent an initial SIP message with an RPH that has not yet been authorized, and if so, places the new SIP message in a buffer.