Most likely because they have CloudFlare's UAM (Under attack mode) enabled. Which is misconfigured (horribly) as it wasn't effective at all against any penetration test that was happening on their site hours ago.