Most likely using "Spectrum" which allows Layer 4 TCP+UDP proxying/DDoS protection: https://www.cloudflare.com/application-services/products/clo...