This is what it looks like when ieji.de gets ddosed, half the cores busy dealing with ksoftirqd processes, didn't took long for it to get filtered using suricata+crowdsec, ssh port was tcp synflooded.