This is the first time I think that I can see an attacker using a large number of sequential IP addresses: "Null routing: 194.61.54.0/23". I'm glad I have the subnet based rule consolidator in place, now that traffic is black holed.