From some of your comments, it seems like you are heavily involved with similar situation as former CloudFlare customer?
put it this way: if I am a security researcher and I want to publish a paper on DoDs, I can make use of CloudFlare to accomplish my objective. How do you distinguish good from the bad?
I'm not and have never been a CloudFlare customer. My experience with them stems from hosting game servers and dealing with many DDoS incidents, nearly all of which originated from CloudFlare-"supported" (I would like to use the term "hosting" but I realize they will dispute this, and I'm not interested in a debate on semantics) booters. As part of this, I also have experience dealing with CloudFlare, which I detailed in another comment here.
Publishing research papers about DDoS attacks is one thing. Selling a service that performs them (i.e. DDoS-for-hire) is completely different, IMO.
put it this way: if I am a security researcher and I want to publish a paper on DoDs, I can make use of CloudFlare to accomplish my objective. How do you distinguish good from the bad?
What do you propose they should do?