Basically, it goes like this. When a call comes in via DID, the block number defined in 7600 (for the DID digits-to-Block Number) is searched for in Command 7626. If that DID needs to be screened, the block number will have an entry of 0,1 or 2, in 7626, defining which Development table should be used to check the Caller ID number. If there is no match in CM 7626, the call is processed normally. If 7626 has specifed Dev.Table 0, the system checks Command 2A50 for a Caller ID match. In 2A50, you enter the desired CID to match, and the new DID block number to use to route that caller. (If the entry in 7626 is a 1, use CM 2A51). If there is no CID match, the call is routed via the block number defined in 7600. So, if you know what DID number your bad actor is calling, you can set its DID block number in 7626. If you don't, you may need to put all block numbers (000-999, or whatever is actually used) in 7626. Let me know if you need an example.

Thanks for the help.
I understand most of that and will have to try it again, in the meantime I have set up a different method using caller redirect where the users can identify the incoming callers number and press the redirect button and send that caller to a virtual extension that rings 25 times then the VRS will state the caller is unavailable and hang up the call. Same in the UCB using caller profiles for those numbers that get to the VM using the DIDs.