Thread from earlier today: https://news.ycombinator.com/item?id=16737583
599 karma · joined September 14, 2012
(disclaimer: I work on DNSTrails) Another way to find the origin is to use trails left by DNS using a tool like https://www.DNSTrails.com.
You can see a sample with a site that moved to Cloudflare like this: https://dnstrails.com/domain/haveibeenpwned.com