By the nature of how Cloudflare works, you have to provide them with your domain name and the content of your website.
See if you could come up with a simple regular expression to deny services to these well known DDoS providers that are actively using Cloudflare:
CryptoStresser.com Instant-Stresser.com FreeStresser.so StresserAI.com Booter.sx Flystress.net Bootyou.net