I went deep inside a rabbit hole in trying to discover paying Cloudflare customers (for a technographic I am building in Bloomberry), and wrote up some tactics on how to detect if a conpany is a paying Cloudflare user.

Involves analyzing custom error pages, IP ranges, following redirects, etc.