The are 3 reasons for that:
- Some DNS servers still use previously cached records and not all traffic is filtered by G-Core Labs. You need to wait.
- You didn't change your real IP to a new one after you had enabled DDoS Protection. It means that an attacker knows it so you need to get new IP from your hosting.
- You didn't limit access to your server. Сontact your hosting provider or use a firewall to set up ACL.