I'm curious about this too, but at least in some cases the reason is the sites don't start off with DDoS protection, they signup with Cloudflare to mitigate the

I'm curious about this too, but at least in some cases the reason is the sites don't start off with DDoS protection, they signup with Cloudflare to mitigate the attack in progress.