Attacks continues, and unfortunately CloudFlare can't protect server, because attack is pointed right to the server IP, not domain name.
Attack it very powerful, server gets about 2 000 000 requests every second before IP locked by upstream provider.
I plan to move main processing server to the new hosting provider with advanced DDOS protection, It will take several days to move.
If you have IPv6 support, you can try access website with address http://[2a01:4f8:190:84f8::2]
Can't you block direct access to your site from any IP which does not belong to cloudflare?