[t0x1cZ]

If the target website has protection like CloudFlare, pinging will result in the IP of a CloudFlare server.
But sometimes, bad configurations from the admins will result in sub-domains being unguarded.
Example. Instead of pinging "sinister.ly"

ping 'ftp.sinister.ly', or 'cpanel.sinister.ly' (won't work, site is properly configured)

Another method, if you receive an email from a domain other than @Gmail then it isn't automatically protected. To view the IP of the sender you can click on the little triangle to the right of the reply button and view original. From there, you will see the IP of the domain that it was sent from, UNLESS that is also properly configured. Sinister.ly is properly configured in that aspect too.

There are many other methods too, but for the sake of time and space, I end here.

[Yaiba]

I'll be using this on some unfavored website. Does this work on bigger websites and forums or just smaller ones?

[DarkMuse]

I'll be using this on some unfavored website. Does this work on bigger websites and forums or just smaller ones?

whelp:

If the target website has protection like CloudFlare, pinging will result in the IP of a CloudFlare server.
But sometimes, bad configurations from the admins will result in sub-domains being unguarded.

I'll let you decide

[Darkbyte]

On a forum im on (s.e forum) they had a issue I found. You could set a custom avatar in the forum but first the server would go out and make sure the image size was ok , it was a valid image ect. To do that the server sent a outbound connection. This revealed the servers true ip address.