@jonn @cblgh yeah they managed to scrape my origin server behind Cloudflare from IPv4 manually (there's no hostname pointed at it) and then attacked it directly. it took my site down for a few minutes until I added rules in AWS to block everything except Cloudflare's IPs.