You could try using something like domaintools to check their historic DNS records, before they had DDoS protection, if you can find the raw IP address you can bypass the protection. Sometimes historic records will tell you this kind of information. ;) Archive.org, etc. Also sometimes if you lodge an abuse request to the DDoS provider they will actually tell you the IP or at least who its hosted with, they have to have a way of managing complaints against the IP which is a potential attack vector. ;)