This is fairly typical and part of how the VCS operates and it is somewhat the nature of the design.
Can you post some of the VCS-E search history?
You are likely seeing calls from this IP as well as other IP and spoofed aliases like 100@1.1.1.1, 1@cisco, etc.) People use scripts and tools like SIPVicous to scan public IP addresses for an open port 5060, then typically attempt to commit toll fraud by calling international numbers. You are on the right track using a CPL. There are also ways to use search rules to rotue these calls to a dead end, however I prefer using a CPL myself.
The issue here is that the VCS inbound connections need to be left open at the firewall so the VCS can accept calls from anyone (which is usually desired however if you have more of a privatized video network you could potentially lock this down more).
My suggestion would be to utilize the CPL and make it good and robust to block common attacks from source aliases like, 1.1.1.1, 2.2.2.2, cisco, asterisk, etc. And in addition to this, I would possibly request that the individual IP addresses that are hitting the VCSe are blocked by the firewall. Depending on your VCS version and deployment model, you can also use the built in firewall functionality of the VCS to block these calls. They will likely still be noticed by the ASA however.
