Can you take us down?

This server is protected by Cloudflare Free and DDactic's automated IR pipeline. No paid WAF. No scrubbing centers. No human on-call. Just code.

ONLINE

Rules of engagement

01 L7 only. Application-layer attacks against this domain. HTTP floods, slowloris, HTTP/2 abuse, credential stuffing patterns - all fair game.
02 No amplification. No DNS reflection, NTP monlist, memcached, or any reflected/amplified volumetric attacks. Your traffic, your IPs.
03 No volumetric L3/L4. This is not a bandwidth contest. We are testing application-layer resilience and automated response, not pipe size.
04 Be creative. Rotate fingerprints. Vary request patterns. Mimic real browsers. The more sophisticated the attack, the better the test.

How it works

Step 01

Beacon

DDactic beacons continuously monitor inbound traffic patterns, latency, and request distribution.

Step 02

Classify

The traffic classifier detects anomalies, fingerprints attack tools, and identifies threat categories in real time.

Step 03

Respond

Matching playbooks auto-execute: rate limits, challenge pages, IP blocks, geo-fencing - all without human input.

Step 04

Adapt

The pipeline learns from each attack. Fingerprints are stored. Thresholds recalibrate. Next time is faster.

Challenge tracks

We're rolling out multiple defender stacks on rotating hostnames. Each track fronts the same demo app with a different vendor or protection class so you can compare how each one holds up under the same attack. At most two tracks are live at a time, rotating every ~14 days.