well the cloudflare can be passed when the real IP behind is identified via some tricks like mails etc.
Generally mail server IPs remain different from web server IPs. But, I'm not sure whether attacking mail server also affects the web server in some way.