Well it's a bit old now but a few years ago on the Hiawatha blog a test of load under attack was done and Hiawatha was able to handle a simulated (d?)dos very well.

I'm on mobile but a quick ddg show: https://www.hiawatha-webserver.org/weblog/64