Both the phishing and malware attacks would be performed over CloudFlare's networks, while the DDoS attacks would not.

What happens over CloudFlare's networks in the case of DDoS providers would essentially be the agreement of a business contract.