Cloudflare Origin IP Discovery

I am conducting an authorised security assessment on a website that currently sits behind Cloudflare. The owner has given me written permission to verify how well the service hides the origin server, and my first objective is simple: locate the true, routable IP address of that server.

What I need from you
• Discover the origin IP without disrupting production traffic or triggering any Cloudflare security events.
• Confirm that browsing directly to the uncovered IP renders the site identically to the public domain (same content, layout, and functionality).
• Provide a concise report describing the exact approach—whether you relied on passive DNS enumeration (dig, SecurityTrails, Shodan etc.), historical records, sub-domain leakage, server misconfiguration, or any other non-intrusive technique—so the owner can understand the exposure and remediate it.

Acceptance criteria
1. A single IPv4 (and IPv6, if present) address that serves the live site outside Cloudflare.
2. Screenshot or screencast proof of the page loading from that raw address.
3. Step-by-step notes that another tester could follow to reproduce the result.

This is a focused, one-off task; once the IP is confirmed and documented the engagement is complete. Please outline your estimated turnaround time along with any clarifying questions you might have.