Who Me Too'd this topic

I have the threat-detection setup like the following:

threat-detection rate scanning-threat rate-interval 600 average-rate 6 burst-rate 20
threat-detection rate scanning-threat rate-interval 1200 average-rate 5 burst-rate 15
threat-detection rate scanning-threat rate-interval 3600 average-rate 4 burst-rate 8
threat-detection basic-threat
threat-detection scanning-threat shun except ip-address 10.1.0.0 255.255.0.0
threat-detection scanning-threat shun except ip-address 10.2.0.0 255.255.0.0
threat-detection scanning-threat shun except ip-address 10.1.0.40 255.255.255.255
threat-detection scanning-threat shun except ip-address 10.4.5.0 255.255.255.0
threat-detection scanning-threat shun except ip-address 10.1.5.0 255.255.255.0
threat-detection scanning-threat shun except ip-address 10.2.5.0 255.255.255.0
threat-detection scanning-threat shun duration 3600
threat-detection statistics host
threat-detection statistics port
threat-detection statistics access-list
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200

Though I still receieve these events in the syslog.

The Devices that are generating them (I believe) are IP Phones. They are the devices listed in the 10.x.5.0/24 range.

When I do a 'show shun'  I get nothing back.

What Gives?