Cloudflare Find origin servers of websites behind by CloudFlare using Internet-wide scan data from Censys

Actually that's very old news But guess Cloudflare ain't happy about it!

As outlined in those articles to protect yourself you can either use firewall to block all traffic other than Cloudflare from your server or setup a Cloudflare Authenticated Origin Pull certificate on your Cloudflare Full SSL enabled site. The latter is easier to do as blocking all traffic might cause problems for other non-visitor access/communications to your server. I wrote a guide for the latter at Cloudflare - Setting Up Cloudflare Authenticated Origin Pulls Protecting IP Leaks

 

Nice.. just remember Cloudflare Authenticated Origin Pull certificates also expire Cloudflare - Setting Up Cloudflare Authenticated Origin Pulls Protecting IP Leaks