Using one of these commands
Code:
ping ftp.example.com
ping mail.example.com
ping subdomain.example.com
Replace example.com with the domain that you want to find real IP address of a website that using Cloudflare. Note that if they configure ftp, mail, subdomain on Cloudflare DNS then these commands will not work, you need to use other ways to find.
Just cuious, why you want to find real IP of a website behind CloudFlare?