You've requested an IP address that is part of the Cloudflare network. A valid Host header must be supplied to reach the desired website.

Maybe a workaround exists, if the Host header could be modified manually or would that simply result in the poisoned dns ip being returned...

Found this: https://serverfault.com/questions/1008522/what-enables-cloudflare-to-disable-direct-ip-address-access

A classical example looks like this:

GET /pub/WWW/TheProject.html HTTP/1.1

Host: www.w3.org

...

In your case, the request contains an IP address for the host specifier.

GET /whatever HTTP/1.1

Host: a.b.c.d

So if CloudFlare is blocking any request with an IP address for Host instead of domain name, then that might make all cloudflare sites unusable in the event of DNS poisoning since they would resolve the hostname to the wrong IP.