Yeah CloudFlare is not a hosting provider, so that piece seems erroneous. They are on the CDN line below, I just don't understand why they ended up on this line. Maybe because people's DNS points at CloudFlare?
That's correct, but it's very difficult to determine the hosting environment if you're using a CDN. I have a write up on my blog at https://www.gra.pe/?p=36. But the idea is that if you know the hosting IP, you now where the IP sits (ASN). If you determine the ASN, you know which provider is being used.
To add to this - what they probably did was run an nslookup or dig against the domains themselves. And whatever IP resolved for those domains, they checked who owned that IP space. With a CDN, it won't show AWS, it'll show the CDN.
Cloudflare is a CDN exclusively, right? Why are they counted among the hosting providers and not with CDNs in the next line?