Yes, exactly. Despite the fact that my domain is not listed anyone online, cloudflare dashboard says they blocked 1000s of attempts last month.
Do you have your origin whitelisted to cloudflares edge ranges? If not it can be hilariously easy to get around cloudflare (ex: Hamas.ps is behind cloudflare but runs on Hetzner https://censys.io/ipv4?q=hamas.ps)