I would have thought a block at Cloudflare would also block the traffic. I can see cached and uncached in in a graph but not blocked data. Why would someone still hit cloudflare with 18GB of data for 10 hours?
I suspect the Cloudflare firewall is not working as they doubled the scan rate and I have had 134,000 probes in 24 hours. I was able to re block the ip (strangely it said it was not a duplicate record)