These DDOS attacks even with Cloudfare protection are pretty easy. from my limited understanding. If your origin IP for your domain is public, then the attackers can bypass the cloudfare by using the origin IP of the site/host. I'll PM nicehash some details.
Yeah, your limited understanding is failing you. With Cloudflare, you don't know the IP of the webservers. All you know are the IPs of Cloudflare.