... I don't think people are using cloudflare to protect something willy nilly.
My general experience is, if you host a popular site, it will be DDOS'd.
If you host a site in a 'competitive' space, you will get DDOS'd.
I've seen it all personally, forums, image upload sites, NFT galleries, and SAAS health tech even, people will spend a couple hundred dollars to make you miserable.
If you don't have protection, they can literally see how you are falling and it only encourages further spend.
Also, Cloudflare is one of the easier free gateways to set up for your domain. Lots of people are using that (and Cloudflare apps) and they probably enable these protections without giving it a second thought.
I spoke too strongly to say they keep them online intentionally. The services do per se violate their AUP but because CF protects their identity, CF becomes the arbiter of taking them offline, and doesn't always agree to do so.
My general experience is, if you host a popular site, it will be DDOS'd.
If you host a site in a 'competitive' space, you will get DDOS'd.
I've seen it all personally, forums, image upload sites, NFT galleries, and SAAS health tech even, people will spend a couple hundred dollars to make you miserable.
If you don't have protection, they can literally see how you are falling and it only encourages further spend.