How to find the true ip of someone's server or vps, even if it's behind cloudflare
Reconnaissance:
Find information about the true hosting provider.
If you know the hosting provider, you can find the ASN of that provider. Then, using something like iptracker you can find all ip ranges that ASN operates.
Narrow down the number of ip addresses to search through and prioritize offline methods to do so.
If you know the general location that the server likely is located in, you can use a maxmind db to decrease the number of possible ip addresses. You can write a quick script to filter by continent, country, etc.
Use osint sites and tools to look for possible leaks.
Certificate transparency sites like crt.sh are helpful and can be used to find historical information about domains.
Virustotal also has some great tools for finding subdomains and searching for historical records.
Shodan is also a good place to look for clues
Any information is good information. Even if an ip is leaked that is no longer valid, it can give you clues about the hosting provider and location of the current ip.
Find what other services the server is likely running.
If the site has any sort of service that exposes external ports (like gitea, jellyfin, proxmox, minecraft, etc), that's useful information. Finding open ports is trivially brute-forceable, and does not take a significant amount of time, especially if you have narrowed the prospective ip range down significantly enough.
Brute force:
Use masscan. Masscan is able to quickly scan a large number of ip addresses and find open tcp ports.
This is relevant to my previous point on finding services the server is running. If you scan for ports associated with those services, you can correlate to find addresses that have those ports open.
While finding ips with matching ports is useful, it is not necessarily able to find definitive proof of the true ip. This strategy is still only useful for narrowing down the number of ip address candidates.
Use host header spoofing and brute force to find servers that respond.
Usually webservers respond to any request, even if it's not from cloudflare, and is going directly to the ip, as long as the host header is properly defined.
If you search the results for a certain piece of text that you know is on the true website, you can find the exact ip.
Beware of http proxies! There are a lot of ips around there that will forward your request based on the host header to the true website, causing a false positive.
Only use this strategy if you have narrowed down the search radius significantly enough. This strategy will be no fun if you still have to search through hundreds of thousands of ip addresses, and something is bound to go wrong.
Sometimes, people limit their webserver to only respond to ips within cloudflare's posted edge ip ranges. This can be trivially bypassed using warp. After connecting to warp, cross-reference your public ip with cloudflare's edge ip ranges and reconnect until you get a match.
If the webserver is properly configured to require a cryptographic mtls cert from cloudflare, this method probably won't be very useful, even if you filter by specific ssl errors.