They need to tweak their cloudflare setting is all
Not sure if they changed their old IP afternoon cloudflare, as I suggested before, if not they're still wide open.
Edit: nope they didn't change it and they have 64 hostnames pointing to that same IP :/
Step 10 here - change IP after setup