Great post. Also, Cloudflare Warp looks like it will be cool.

(disclaimer: I work on DNSTrails) Another way to find the origin is to use trails left by DNS using a tool like https://www.DNSTrails.com.

You can see a sample with a site that moved to Cloudflare like this: https://dnstrails.com/domain/haveibeenpwned.com