Guys at Easy Blog Networks have another awesome post about footprints. They analyzed 60 PBNs that were given by The Proper PBN Group users and used CloudFlare. They found that two thirds of those sites leak the real IP.
Here are the methods they used to find the IPs or potential footprints with CloudFlare:
- CloudFlare nameservers (limited amount of combinations)
- Misconfigured zonefile with CloudFlare
- MX records show real IP
- CrimeFlare keeps a history of sites on CloudFlare
- cPanel leaks
- WordPress pingbacks
- Server default page
I highly recommend you jump to their blog and read the whole blog post.