Most of these spammers just emit events to a large range of GA tracking ids completely blindly, think of it as the equivalent of... for (var i=0; i<100000;

Most of these spammers just emit events to a large range of GA tracking ids completely blindly, think of it as the equivalent of... for (var i=0; i<100000; i++) { ga('create', 'UA-' + i + '-1'); ga('send', 'pageview'); // But with a fake referrer } They do that a bunch of times per day from a bunch of different IP addresses. Adding host filtering to your properties on GA eliminates about 80% of spam which use this technique. It's possible you're being targeted due to being in a specific market or something, but it's unlikely to be related to Cloudflare. (At least I can't think of any reason why it would be related.)