Pentesting KVM Scanning & scraping VPS

Q: What is a Pentesting KVM?

A KVM server built for security work: web scraping and zmap / masscan scanning are explicitly allowed, with full root access, ready-made OS templates and an isolated network segment. You may only test systems you own or have written permission to assess; attacks against third parties are never allowed.

Q: Can I run Kali Linux?

Yes, through Docker. There is no Kali image on the order form, so install Debian from a template and run Kali's official kalilinux/kali-rolling container, adding its tools with the kali-linux-headless package. For a tool that needs a screen, add an Xfce desktop over xrdp. The steps on this page show the commands.

Q: How much RAM do Kali's tools need?

Kali's own documentation gives about 512 MB of RAM and 2 GB of disk for a command-line install, and 2 GB of RAM with 20 GB of disk once you add the Xfce desktop. Graphical web-testing tools want noticeably more. Start on the plan your tools need and add RAM or disk from the panel later.

Q: Will you null-route me for a masscan sweep?

No. Scan volume is the workload on this line, not abuse: zmap and masscan are allowed by policy from the isolated segment. We step in only when a sweep degrades the platform for other customers, and we come to you with the flow data before we touch anything that can wait.

Q: Do you inspect my traffic?

No. We do not inspect or store packet contents, traffic data or application-level information (Terms of Service, §12), and we do not actively monitor what is on your server. Monitoring is limited to network-level abuse signals and to reports from third parties (Acceptable Use Policy, §08).

Q: What do you tell an abuse complainant?

That the traffic is authorised testing by a customer of ours, and we pass the report to you for an answer. A complaint on its own does not end a service. What we act on without discussion is what the AUP prohibits everywhere (malware, phishing, fraud, spam) and lawful orders from authorities.

Q: Can I set a PTR that identifies my research?

Yes, reverse DNS is yours to set from the panel, and it is the cheapest thing you can do to cut complaint volume. Point it at a hostname with a page and a contact address behind it: a scan that explains itself collects a fraction of the reports an anonymous one does.

Q: Can I run it only while a scope is open?

You can, and it costs the same either way. Plans are prepaid by the month, not billed by the hour, so there is no saving from running the server only during an engagement. Reinstall the template between jobs so each one starts on a clean disk, or keep the box and take a snapshot before the next scope.

Q: Is there a refund on a Pentesting KVM?

Only under the statutory right of withdrawal: consumers can withdraw within 14 days of ordering and get the unused share back as account credit, paying pro rata for the time already used (Terms of Service, §07). Beyond that we do not refund payments; goodwill is only ever given as account credit, at our discretion. So start on the entry plan and upgrade from the panel when a scope needs more, rather than ordering large and hoping for money back.

Q: What payment methods do you accept?

We accept card, PayPal or crypto (Bitcoin, Ethereum, USDT, Litecoin, Monero and more), at the same price for every method. Services are prepaid: no contracts, cancel anytime.

Sweeps with zmap or masscan and a crawler that genuinely crawls are the expected workload here, not an incident: the ranges are set aside for that traffic and the abuse process is written around it. What we ask in return is authorisation: systems you own, or a signed scope from whoever does own them.

AMD EPYC
ECC memory
NVMe storage
Scanning allowed

From€6.99/mo

Choose your plan Talk to sales

PENTEST KVM 5

most chosen configuration

Hosted in the Netherlands

CPU: 6 Cores · AMD EPYC
Memory: 12 GB ECC
Storage: 120 GB
Network: 5 Gbit/s · fair use
Location: Netherlands

€29.99/mo

Deploy PENTEST KVM 5

Full root accessDDoS protectedVNC console

01Plans

Pentesting VPS plans

Prepaid, cancel anytime. Pick your location and billing term, and prices update instantly.

AMD EPYC · Netherlands

PENTEST KVM 1

Tier 1 of 9

€6.99/mo

CPU: 1 Core
RAM: 2 GB ECC
DISK: 20 GB
NET: 200 Mbit/s

PENTEST KVM 2

Tier 2 of 9

€12.99/mo

CPU: 2 Cores
RAM: 4 GB ECC
DISK: 40 GB
NET: 1 Gbit/s

PENTEST KVM 3

Tier 3 of 9

€19.99/mo

CPU: 3 Cores
RAM: 6 GB ECC
DISK: 60 GB
NET: 1 Gbit/s

PENTEST KVM 4

Tier 4 of 9

€26.99/mo

CPU: 4 Cores
RAM: 8 GB ECC
DISK: 80 GB
NET: 2 Gbit/s

PENTEST KVM 5

Most chosen tier

€39.99/mo

CPU: 6 Cores
RAM: 12 GB ECC
DISK: 120 GB
NET: 5 Gbit/s

PENTEST KVM 6

Tier 6 of 9

€52.99/mo

CPU: 8 Cores
RAM: 16 GB ECC
DISK: 150 GB
NET: 10 Gbit/s

PENTEST KVM 7

Tier 7 of 9

€92.99/mo

CPU: 10 Cores
RAM: 20 GB ECC
DISK: 200 GB
NET: 10 Gbit/s

PENTEST KVM 8

Tier 8 of 9

€105.99/mo

CPU: 12 Cores
RAM: 24 GB ECC
DISK: 240 GB
NET: 10 Gbit/s

PENTEST KVM 9

Tier 9 of 9

€132.99/mo

CPU: 14 Cores
RAM: 28 GB ECC
DISK: 280 GB
NET: 10 Gbit/s

Need a different configuration? Ask for a custom build.

02Performance

Written for security work

The abuse process on this line starts from the assumption that the traffic is deliberate. A complaint reaches you with a question attached instead of a suspension notice, and volume by itself is never why a port goes quiet.

The platform underneath

What every plan on this line actually runs on

AMD EPYC
Server-grade AMD cores with ECC memory
Both regions

vCores per plan: 1 – 14
Memory: ECC
Storage: Replicated enterprise NVMe
Virtualisation: KVM · full root access

Pentesting KVM runs on AMD EPYC with ECC memory in Frankfurt and Amsterdam, on the same nine vCore tiers as Hi-CPU KVM.

Wide sweeps are permitted

zmap, masscan and a full internet-wide run are inside the policy from these ranges, against targets you are authorised to touch.

Scrapers are not an incident

Collectors and crawlers run at whatever rate the target tolerates; nobody here null-routes a customer for asking a site too many questions.

Kept apart from the rest

This line has its own IP space, so a neighbour's reputation is never your problem and yours is never theirs.

A fresh box per engagement

Root, VNC and a template reinstall: stand a machine up for the scope window and return it to zero once the report is signed.

03Platform

What you actually get

Authorised testing, and its edge

Scanning and scraping are permitted; attacking third parties is not, and the whole difference is written permission you could produce if asked. Malware, phishing, fraud and mass mail sit outside the policy on this line exactly as everywhere else, and a lawful order from an authority is complied with rather than argued over.

What a complaint actually costs

A report gets the truthful answer (authorised testing by a customer of ours) and then comes to you for a reply, rather than turning into a suspension. Setting a PTR in the panel that names the project and a contact address shortens that conversation; a sweep from an anonymous host collects far more reports than one that explains itself.

AMD EPYC, 1 to 14 vCores

This is the Hi-CPU platform on scanning-friendly ranges: AMD EPYC with ECC memory, in nine tiers. A masscan run hits the port and the connection table long before it runs out of cores, which is why the line is built on this ladder rather than the 32-vCore one.

Room for what you collected

20 to 280 GB of enterprise NVMe on a replicated cluster: scan output, packet captures and scraped corpora exist on more than one node, and a snapshot before a tooling change is a click. Taking the results off the box when an engagement closes is still your job, not ours.

Up when the scope opens, gone when it closes

Deployment is automatic at any hour, so an instance can exist for the length of a scope window and not a day longer. Reinstall from a template between engagements and the next client begins on a machine carrying nothing from the last one.

Engineers who have read a scope

Reach us on Telegram, Discord or by mail at any hour, and the person replying knows why a box is sitting on a connection table full of half-open sockets. Bring the scope question before the run rather than after the first complaint: a second opinion costs one message and can save the engagement.

04Operating Systems

Your stack, your image

Ready-made templates for popular Linux distributions and Windows Server: reinstall in one click, anytime.

Ubuntu
LTS releases: the default choice
Debian
Stable and lean, for servers that just run
CentOS
CentOS Stream, RHEL-compatible
Rocky Linux
Enterprise Linux, RHEL-compatible
Windows Server
Remote Desktop as Administrator

Coming soon

AlmaLinux
Fedora
Arch Linux
openSUSE

05Use Cases

What people run on it

Typical workloads our customers deploy on this line.

Web scraping
zmap scanning
masscan sweeps
Penetration tests
Red teaming
Security research
OSINT collection
Crawlers

Test only what you own or have written permission to assess; attacks on third parties are never allowed, and neither is anything the platform forbids everywhere else: malware, phishing, fraud and bulk mail. Both lists are in our Terms of Service.

06Kali tools

Kali Linux tools on a Pentesting KVM

There is no Kali template on the order form. The route Kali's own documentation describes for containers works on every plan: Debian from our templates, Kali's tools in Docker, and a desktop over xrdp when a tool needs one.

01
Debian from the template
Order any plan with Debian 13 or 12, log in as root and install Docker from Debian's own packages. Reinstall the template between engagements and the next client starts on a clean disk.
02
Kali's tools in a container
Run the official kalilinux/kali-rolling image. It ships without Kali's default tool set, so you add it inside the container with the kali-linux-headless metapackage, or only the packages your scope needs.
03
A desktop over xrdp
Some tools want a screen. Install Xfce and xrdp on the server, log in with Remote Desktop as an ordinary user, and keep port 3389 open only to your own address.

Debian 13 · 12, as root

# as root on Debian 13 or 12
apt update && apt install -y docker.io
docker run -it kalilinux/kali-rolling
#   inside the container, add Kali's tools:
#   apt update && apt -y install kali-linux-headless

# a graphical desktop over xrdp, when a tool needs a screen:
apt install -y xfce4 xrdp
ufw allow from YOUR.IP.HERE to any port 3389 proto tcp

Sizing, from Kali's installation documentation: about 512 MB of RAM and 2 GB of disk without a desktop, and 2 GB of RAM with 20 GB of disk once you add the Xfce desktop. Command-line scanning runs on the entry plan; add RAM from the panel if a graphical tool needs more, up to a plan with 28 GB of memory.

What this line allows

Scanning and scraping are the workload here; anything aimed at a system you do not run needs written permission, and the rest of the Acceptable Use Policy applies as on every line.

Activity	Allowed	Condition
Port and host scanning with nmap, masscan or zmap	Yes	The workload this line exists for. Volume alone does not end a service; a complaint comes to you with a question attached. Set a PTR that names the project and a contact.
Web scraping and crawlers	Yes	At whatever rate the target tolerates; a complaint is passed to you for an answer, not turned into a suspension.
Web-application and exploitation tools	With written permission	Only against systems you own or have written permission to assess. The scope is the whole difference.
Anything the AUP forbids everywhere	No	Malware, phishing, fraud and bulk mail are out of policy on this line as on any other, and end the service.

The isolated segment keeps this line's traffic off the ranges other customers sit on; it does not make you anonymous and does not widen what you may test. See the Terms of Service and the Acceptable Use Policy.

07What's allowed

What's allowed on this plan

The one KVM line where scanning is part of the policy. The rest of the Acceptable Use Policy applies here as on every other line.

DMCA notices

Handled under the AUP

A DMCA notice is handled like any other abuse report under the Acceptable Use Policy. For a relaxed takedown policy, choose DMCA Ignored KVM or, on bare metal, DMCA Ignored Dedicated.

Scanning

Allowed

zmap, masscan and web scraping are allowed against systems you own or have written permission to test. Attacking third parties never is.

Always prohibited

On every plan

CSAM, weapons and drugs, malware and botnets, phishing and fraud, spam (unsolicited bulk e-mail), anything that gets the range blacklisted, and anything else illegal under German law. Any of it can end the service without notice and without a refund.

Refunds

As account credit

Consumers can withdraw within 14 days and get the unused share back as VMHeaven account credit. Beyond that there are no refunds. Goodwill is only given as account credit, at our discretion. Credit is never paid out as cash or a bank transfer.

The full rules are in our Acceptable Use Policy; refunds are section 07 of the Terms of Service.

08FAQ

Pentesting questions

Everything you need to know before deploying, and a human if you need more.

Still have questions?

Real engineers on the other end: typical first response within about two hours.

Email us Discord Telegram

< 2 hours Typical first response

24/7/365 Engineers on shift

1000+ Customers supported