axvf

That's certainly the real problem here, the point is you might expect the webserver to prevent indexing but this file can act as an index.

If you run a website behind cloudflare it's worth looking into Email IP leaks.

Sometimes simply registering at a website and looking at the registration confirmation email headers can reveal its real IP.