I used disposable Whonix qube to connect to a site that gives phone numbers for anonimous registration on sites. When you connect to it or reload its page, it appears in Onion Circuits. But after page is loaded goes (let’s call it) “phase two” - you choose country, numbers of what you need, then it displays you a random number of that country that you can copy and paste to the service where you want to register account. So during this phase goes interaction with that site that gives you those numbers (displayed quantity of available phone numbers at the moment, you can select other number and it shows you it and so on), but during all this phase there are no connections between that site and me displayed in Onion Circuits (I checked carefully many times). There is connection with the site where I want to register but not the connection with the site providing numbers. But there are also many, many connections to some onion addresses, beginning from “cflare”. These connections appear mostly during that “phase two” when there is no connection to that site directly, so I guess those addresses may somehow be related to that site (but it’s only my guess). And these connections disappear if to restart Tor Browser or to shut it down. Direct connection to the site appears again only if to reload its page again. This site has no onion mirrors so it’s definitely not these mirrors and those onion addresses always different but always starting from “cflare”.
So what does it all mean? This site can bypass Tor even though I use Qubes or those onion addresses during “phase two” is that connection that goes when I interact with the site during “phase two”? But how can it be so if that site has no onion mirrors and only one clearnet address? And those “cflare” addresses sometimes appear during all connections I make, no matters what qube and OS (Qubes, Tails) I use. So if they somehow provide connection to that site, they’re not related to it directly.
UPDATE: Made a little search and found out that these “cflare” addresses are cloud flare onion addresses (might have guessed), but not sure if I understand how it is (and is it?) related to my case.