Originally Posted by Barry-xlovecam

The owner of GFY may not have changed its server(s) old ip(s) after moving to Cloudflare DNS

Neither Cloudflare's DNS or the ICANN root servers will recurse to a *civilian*. If you need to, look up what recursive DNS is.
The only people that *should* know an IP hiding under Cloudflare's skirts would be the site owner, its employees or agents and the datacenter's personnel and its agents. Also, someone with a badge and a warrant.

Other possibilities would be gfy's registrar leaked -- they might have an old IP or some website with historical domain data -- this assuming the IP address was never changed.

So, it is an inside job, Cloudflare was overwhelmed OR some government organized attack.