Originally Posted by TFCash

If he's on cloudflare, and it's still hitting him, then they got his real IP and are attacking it.

He needs to get a new IP and shut down the old one, of course it would be smart to shut down the hole that gave out his IP to begin with before he changes out the IP

Get rid of anything that doesn't go thru CF, remove mail for now and get an gmail account, then shutdown the old IP and fire up the new one, and he should be good to go. Also make sure he has the "I'm under attack" turned on at CF and the setting set to stop the attack!