What is ddos-sim.com?

ddos-sim.com is a self-service platform for running authorized, bounded DDoS resilience simulations against infrastructure you own. You verify domain ownership, compose a timeline of attack techniques, watch live health metrics, and stop the moment you have your answer.

Is it legal and safe to use?

It is built only for owners and authorized operators. Nothing runs against a target until you have proven ownership of the domain over DNS or HTTPS. Every worker receives one verified domain and rejects any other target, no packets are spoofed, and tests stay inside per-domain rate, concurrency and worker limits.

Which attack techniques can I simulate?

Nine techniques across Layers 3-7: HTTP check, HTTPS check, port check, UDP flood, SYN flood, Slowloris, ICMP flood, SSL/TLS exhaustion, and HTTP/2 rapid reset (the CVE-2023-44487 pattern). Each exercises a real failure mode through the OS network stack rather than spoofed or raw packets.

How much does it cost?

Every workspace gets three free HTTPS resilience tests every rolling 30 days at up to 10,000 requests per second, with no card required. Beyond that, prepaid credit packs start at 30 credits for €10 and scale to 2,000 credits for €299, with no subscription. One usage credit covers one load generator for one minute and each executed test adds two execution credits.

Do I need to verify domain ownership before testing?

Yes. Verification is self-service and takes minutes over DNS or HTTPS. It immediately unlocks standard validation for most techniques. Aggressive network-layer methods such as UDP and SYN floods, plus higher rate, concurrency and worker limits, require extended validation after a manual review.

Authorized resilience testing

Find the breaking point before attackers do.

Q: Can a test stop itself if my service starts failing?

Yes. Live monitoring samples service health as often as every 100 ms across up to eight paths. Set error-rate, latency, or status-code thresholds and the test aborts itself the moment your service crosses them. You can also stop any test manually at any time.

ddos-sim.com launches bounded, authorized DDoS simulations against infrastructure you own. Rehearse real attack techniques across Layers 3–7, watch service health in real time, and stop the instant you have your answer.

Configure a test Browse the simulations

9attack techniques
100mshealth sampling
15free test credits
100%verified targets

portal.ddos-sim.com/tests/248/live running

Paid test #248

Checkout API resilience check

app.example.com · Layer 7 + network sweep

Expected3

Provisioned3

Connected3

Slowloris simulation 01:12 remaining

Live latency · HTTPS 128 ms

2xx 4,812 3xx 12 4xx 3 5xx 0

Ownership verified · bounded plan

Bounded and scoped at every layer, by design:

1verified domain
0spoofed packets
0arbitrary targets
Autoabort on breach
Stripegated execution

The simulation library

Test your services against all common attack methods.

Drop any of these onto a timeline. Each technique is implemented to exercise a real failure mode through the OS network stack — no spoofed or raw packets, no arbitrary payloads — so results are realistic and the blast radius stays known.

HTTP check

http_check

Sends bounded HTTP requests to a path you choose and records status codes and latency.

HTTPS check

https_check

The same bounded request flow over TLS, validating the certificate for the verified domain.

Port check

port_check

Opens a controlled number of TCP connections to a target port to confirm reachability.

UDP flood

udp_flood

Emits a small fixed packet per operation to probe how UDP ingress and rate limits hold up.

Requires extended validation

SYN flood

syn_flood_check

Opens bounded TCP handshakes to pressure the connection table — full handshakes, nothing spoofed.

Requires extended validation

Slowloris

slowloris_check

Holds connections open with a slow trickle of keep-alive bytes to test slow-connection exhaustion.

ICMP flood

icmp_flood

Sends a fixed echo request per operation to measure resilience to network-layer noise.

SSL/TLS exhaustion

tls_exhaustion_check

Completes a full TLS handshake per operation to expose the crypto cost of handshake pressure.

HTTP/2 rapid reset

http2_rapid_reset

Opens and instantly cancels HTTP/2 streams — the CVE-2023-44487 pattern — against real HTTP/2.

Start small, scale when ready

Start after domain validation, scale when fully validated

01

Verify your own domain

Prove ownership over DNS or HTTPS. It's self-service, takes minutes, and nothing ever runs against a target you haven't claimed.
02

Start testing right away

Verification unlocks regular validation immediately — run most techniques against your domain at rate limits sized for everyday resilience checks. No waiting, no sign-off.
03

Request extended validation

Need to push harder? Ask for extended validation. After review, your rate, concurrency, and worker limits go up and the most aggressive network-layer methods unlock — and you can still plan and run every test yourself.
04

Going bigger? We'll help

For very large simulations beyond the self-service limits, talk to us. We'll help you scope, provision, and run the engagement.
Talk to us

Timeline builder

Compose the assessment. See the cost as you go.

Start from a preset, then reorder or overlap commands. The portal turns the required generator capacity and duration into a credit quote before you reserve anything.

Verified target app.example.com verified

Global start Tomorrow · 10:00

8 commands 10m 30s window

Open in the portal

Live health monitoring

Watch the service breathe under load.

Safe HTTPS observations on your verified domain — as often as every 100 ms, across up to eight paths at once, with no redirects followed and private and loopback addresses blocked. Latency and response codes stream to charts you can zoom and pan, every command marked on the timeline. Set error-rate, latency, or status-code thresholds and the test aborts itself the moment your service crosses them.

Live monitoring · app.example.com 10:14:03 UTC

Response latency124 ms

Start+5 minNow

Availability99.98%

Endpoint responsive
Latency within threshold
Workers inside limits

HTTP responses24,860

2xx98.7% 3xx0.8% 4xx0.3% 5xx0.2%

Worker fleet3 / 3 connected

worker-fsn1-a124 ms

worker-fsn1-b131 ms

worker-fsn1-c119 ms

Bounded VMs provisioned two minutes before start, torn down the moment the last task ends.

Non-negotiable safeguards

A stress test, never a weapon.

ddos-sim.com exists for owners and authorized operators. It refuses arbitrary targets and unbounded instructions at every layer — from domain verification in the portal down to the constants compiled into each worker.

Configure a bounded test

Verified domains only

Each worker receives one verified domain and rejects a plan for anything else.

Per-domain limits

Every verified domain tests inside its own rate, concurrency, and worker limits — scaled to its validation level, never a shared free-for-all.

Automatic abort

Set error-rate, latency, or status-code thresholds and the test stops itself the moment your service crosses them.

Full audit trail

Logins, approvals, edits, worker lifecycle, and results stay visible to the workspace.

Start free. Scale on demand.

Run 3 free tests at up to 10,000 requests per second.

Verify a domain and start testing without a card. Every rolling 30 days, your workspace gets three HTTPS resilience tests to learn where your service starts to bend.

Free allowance

Start with

3 tests

every rolling 30 days

Up to 10,000 requests per second
Bounded HTTPS request tests
No HTTP/2 rapid reset, UDP, or SYN floods
No card required to get started

Run your first free test

Paid tests

When you need more

Buy to unlock higher limits and more aggressive attack types.

Purchased credits fund larger, higher-throughput test plans. After extended domain validation, they can also power aggressive network-layer techniques that are intentionally excluded from the free tier. Payment only opens after the exact engagement has been authorized.

1
Agree to the planLock the exact target, timeline, and traffic profile.
2
Sign the Rules of EngagementAn authorized representative accepts the operating boundaries.
3
Admin approval, then paymentCheckout unlocks only after our review.

Configure a larger test

Prepaid credits

Pricing that scales with your testing.

No subscription or recurring monthly commitment.

Try 30 credits

€10 €0.33 / credit

Starter 100 credits

€29 €0.29 / credit

Growth Popular 500 credits

€99 €0.20 / credit

Scale 2,000 credits

€299 €0.15 / credit

The whole platform

A self-service portal built for responsible teams.

Multi-tenant workspaces

Invite members, assign roles, and keep every test scoped to your organization.

Domain verification

DNS or HTTPS proof of ownership gates every target before it can be scheduled.

Two-factor auth

TOTP-based 2FA and email-verified sign-up protect access to your workspace.

Audit log

A complete, tenant-scoped record of logins, changes, and test lifecycle events.

Billing & invoices

Stripe-hosted checkout and invoices for prepaid credit packs, with a complete workspace ledger.

Support tickets

Open tickets with attachments, subscribe teammates, and keep the thread in one place.

Ready when you are

Rehearse the worst day. At a time of your choosing.

Build a timeline in the browser now — no account needed to draft one. Create a workspace when you're ready to verify a domain and run it.

Configure a test Create an account