Suspended two times in three days

Without a custom domain that you can direct through cloudflare, it’s very difficult to stop bots in my experience. If you think that is a deliberate attack you could try temporarily dialling your site for a week to make them think they’ve won, then reactivate it. But that’s not guaranteed