zlacker

>>dredmo+(OP)
On the subject of the IP leaking: Note that IPv4 only has 2^32 addresses, and people can and do mass scan all of them (see here shodan.io). If your service is exposing any identifiable information (ie. if it's not completely blocking all non-cloudflare IPs) then it's fairly easy to find even if it's "unguessable".

>>ekimek+ye
Cloudflare EM for DDoS Protection here.

If a customer wants to hide their IP then the best way to do it:

1. Onboard onto Cloudflare

2. Audit your app and ensure you aren't leaking your IP (are you sending email directly? making web calls directly? - make adjustments to use APIs of other providers, i.e. send emails via Sendgrid API, etc)

3. Change your IP (it was previously public knowledge in your DNS records)

At this point your IP should be unknown, so...

4. Use `cloudflared` and https://www.cloudflare.com/en-gb/products/argo-tunnel/ to have your server call us, rather than us call you (via DNS A / AAAA records)

Because this connects a tunnel from your server, you can configure iptables and your firewall to close everything :)

Here's the help info: https://developers.cloudflare.com/argo-tunnel/quickstart/

PS: to the OP I tried to contact you via keybase, feel free to ping my email. We are working to improve the DDoS protection for attacks in the range you were impacted by and the product manager would enjoy your feedback if you're willing to share them in the new year.