How to find real IP Address of website behind a could based firewall

1- Censys
https://censys.io/
2- Shodan
https://www.shodan.io/
3- zoomeye
https://www.zoomeye.org/
4- securitytrails/dnstrail
https://securitytrails.com/
5- crimeflare
http://crimeflare.com/
6- netcraft
https://toolbar.netcraft.com/site_report
7- dns lookup for MX Record misconfiguration
8- subdomains lookup
9- Website leaking IP address through email headers
10- Reverse lookup ip ranges for target company, and banner grab port 80
11- WordPress Pingback
12- External avatars