Tools usually query a database like Shodan, DNSDumpster, etc for the target host and check if any of the returned IP addresses aren’t behind Cloudflare.
When this doesn’t work, you need to bring out the big guns as Carlos explains here ?
https://t.co/zQgY2s2u6F