Besides Cloudflare being the biggest man-in-the-middle on the internet, their DDoS mitigation offering is also questionable. If you google &quot;clouflare bypass&quot; [1], you get to websites that can tell you the origin IP address of a cloudflare customer&#x27;s domain name. So, malicious guys could hit the real IP directly.<p>[1] <a href="https:&#x2F;&#x2F;www.google.com&#x2F;search?q=cloudflare+bypass" rel="nofollow">https:&#x2F;&#x2F;www.google.com&#x2F;search?q=cloudflare+bypass</a>