Look it’s important … The file2ban is deceived by the log !!!
In the log it comes like this:
[2018-02-02 06:39:11] VERBOSE [16707] [C-00000a10] pbx.c: Executing [s @ from-sip-external: 6] Log (“SIP / 62.94.218.226-00000d33”, " WARNING, “Rejecting unknown SIP connection from 54.37.131.175” ") in new stack
[2018-02-02 06:39:11] WARNING [16707] [C-00000a10] Ext. S: “Rejecting unknown SIP connection from 54.37.131.175”
You will see that the IP address is followed by double repeated quotation marks: 54.37.131.175 “”
I think this deceives the control rules of the file2ban what do you think ???