OCC server URL exposed vulnerability

If we navigate to our public sites and query the browser console for the object window.state.clientRepository.context.global.appServerURL, it returns the site https://xxxxxxx-store.occa.us-phoenix-1.ocs.oraclecloud.com/, which is the URL of the OCC server.

We would like confirmation that, despite being able to query the server directly, the WAF (Web Application Firewall) still exists between the OCC server and the internet. Therefore, we would not be vulnerable if an attacker were to find that URL within our OCC sites. Can you certify/confirm that this is the case?