These DDOS attacks even with Cloudfare protection are pretty easy. from my limited understanding.  If your origin IP for your domain is public, then the attackers can bypass the cloudfare by using the origin IP of the site/host.  I'll PM nicehash some details.