>the problem is that if a site is served via CloudFlare, there's no easy way to identify and communicate with the actual hosting company
Isn't that the the entire point, though?
Isn't that the the entire point, though?
Of course one might argue that revealing the origin IP exposes it to DOS attacks, but this is a different issue.