[jessaustin]

...the attacker could still find their direct servers fairly easily and attack that IP.

Can the upstream to the actual server restrict traffic to known Cloudflare blocks?

[scottbruin]

We've had issues with saturated upstreams and then been negotiating new ISP connections. All the ISPs I've asked (Level3, NLayer, Cogent) won't put an active restriction to only CDN blocks upstream.

The ISPs will help during a DDOS but response times are slow and we haven't tried getting them to put this type of block in place yet.