It's actually much easier than you'd expect. Lets take a rather large (if now shitty) webmaster forum which uses CloudFlare to mask it's host details. A quick whois on the domain reveals the following information:
Name Server(s)
EVA.NS.CLOUDFLARE.COM (has 570,800 domains)
SETH.NS.CLOUDFLARE.COM (has 570,800 domains)
IP Address 104.28.4.42 - 402 other sites hosted on this server
IP Location - Arizona - Phoenix - Cloudflare Inc.
On its own, that doesn't tell us much, beyond what you can see. But with a little web magic, which I won't publish (if you really want to know how then Google is your friend), we can find out the 'actual' host IP, which is:
IP: 108.61.22.163 - Country: United States - State: New Jersey - City: Sayreville
A further whois of the host IP (shown on the left) reveals the following:
IP Location
United States Elizabeth Gtech Inc ASN AS20473 AS-CHOOPA - Choopa, LLC,US (registered May 11, 2001)
Whois Server whois.arin.net
IP Address 108.61.22.163
So there you go, in less than 1 minute (quite literally), we now have their host IP which was masked by CloudFlare.