sipcli scanner

[sm8651]

1. Brekeke Product Name and Version:
sip server verizon 3, the latest

2. Your problem:
I have a issue, i created a rule to block any sipcli scanners, for some reason they are still coming into the system and calls are even going out to my carriers, they bluff the from as the IP of the server and then just dial out. see attached the calls and the rule I made. Can you tell me whats wrong with the rule why isn't it blocking them on rule 1.

matching patters: $str.lowercase(User-Agent) = sipcli|sipcli/v1.8
depoly pattern: $action = block

this is one of the calls going out
78
sip:8001@server IP
sip:777700972599958210@72.15.219.140
00:00:00.000 2016-06-20 23:54:44.870
2016-06-20 23:54:44.892
Failure 503
23.239.84.84:5078
72.15.219.140 Error
outgoing to termination
sipcli/v1.8
VCSR

[ambrosio]

Do you have the rule "outgoing to termination" ? and does it match before the blocking rule?

The blocking rule must be executed prior to other rules.

[sm8651]

Do you have the rule "outgoing to termination" ? and does it match before the blocking rule?

The blocking rule must be executed prior to other rules.

The block rule is rule #1 and outgoing is rule 200

[ambrosio]

Have you pushed the [Apply Rules] button or restarted the Brekeke SIP Server after you added the block rule?

[sm8651]

Have you pushed the [Apply Rules] button or restarted the Brekeke SIP Server after you added the block rule?

Yes sure, i tied so many ways, still haven't figured it out why its not blocking the calls on rule 1.

[ambrosio]

What the name of the rule is Rule-1?

Do you have any definition other than $str.lowercase(User-Agent) in the Matching Pattern?

Do you have any definition other than $action=block in the Deploy Pattern?