[problems]

Yes, CloudFlare even provides official lists for this purpose.

https://www.cloudflare.com/ips/

IPv4 space is far too small not to use this. Often times if an attacker has determined your provider in the past, they may be able to leverage that information and scan only nearby ranges.

Other common anti-DDoS proxy bypass tactics:

- direct.* subdomain used to be used by default on CloudFlare for a direct route to the server

- Check headers in outgoing emails for an origin IP (this one gets way too many sites)

- CloudFlare only recently got websocket support - check if their websocket servers are secured or not

- Check for an MX record

- Use DNS bruteforcing tools to attempt to find other services

[fyfy18]

> Check headers in outgoing emails for an origin IP (this one gets way too many sites)

Are there any workarounds for this, other than running mail servers on a separate network and IP range?

[Meekro]

Use Amazon SES to send your email. SES actually conceals your origin IP -- unlike other providers like Sendgrid, which include it.

[problems]

Run your mail server on a different provider and configure it to strip the relay headers - some mail relay services may also work for this purpose.