Trouble blocking URL groups

Question

I am having a strange problem trying to block a script from a page. Here is the complete url of the script http://js.moatads.com/aolvidiblecontent859375382/moatvideo.js#_moatApi62941153 
 What I have done is block it via URL group in web filter by blocking js.moatads.com. I also tried blocking moatads.com. If I try to go to maotds.com or js.moatds.com, I get the page blocked as expected. However if I try the full url, I get the script. The logs show moatads.com being blocked however the full URL shows allowed under the same firewall rule. Don't really understand what is going on. Here is the firewall log 
 
 and here is the URL group that i tried to block 
 
 Here is the web policy 
 
 and the firewall policy 
 
 There is nothing in the application logs. Any help is appreciated.

Billybob · Answer

Michael Dunn said: 
 Can you confirm that "Always allow these" was in fact turned off during the test? 
 Thanks for the hint Michael. The always allow these was turned off. I had some stuff left over in there from the beta to allow access to my gateway without web filtering. In your test above, http://js.moatads.com/aol was blocked and everything else was allowed by webfiltering. 
 Because of your hint, I started looking at other regex exceptions and the problem was one of the exceptions that I had created for netflix using this article https://community.sophos.com/kb/en-us/125061 . The offending regex is 
 
 198.45.(4[8-9])|(5[2-8])|(6[1-3]).* 
 
 In the url, js.moatads.com/aolvidiblecontent859375382/moatvideo.js#_moatApi62941153 I guess 5[2-8] is matching 53 and I can see the last portion 6[1-3].* allowing 62941153 but I am still not really sure why it allows http://js.moatads.com/aolvidiblecontent859375382/ . I guess I will have to cleanup that huge list of netflix regex[:#] 
 Thanks again for your insight.