Let's say you wanted to list the IP addresses associated with a second-level domain. For example, let's say you needed all the IP addresses listed in DNS that would match "*.acm.org".
There are tools like Netcraft's searchDNS tool:
http://searchdns.netcraft.com/?host
which can do part of this. For example, Netcraft's searchDNS can return information about third-level domains. This could be scraped and then it's just a matter of periodically running individual DNS queries for these sites (and updating the list) to get a decent list of IP addresses. Granted, their could be services used by, for example, ACM that don't have registered domain names that would match "*.acm.org". But this would be a decent start. Comments?
Comment feed for this post
mroth@basalt:~$ nslookup acm.org
Server: 192.168.1.1
Address: 192.168.1.1#53
Non-authoritative answer:
Name: acm.org
Address: 199.222.69.111
mroth@basalt:~$ whois 199.222.69.111
ANS Communications, Inc ANS-C-BLOCK2 (NET-199-219-0-0-1)
199.219.0.0 - 199.222.255.255
Association for Computing Machiner ACM-NET (NET-199-222-69-0-1)
199.222.69.0 - 199.222.69.255
# ARIN WHOIS database, last updated 2006-04-29 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.
Of course, using the entire netblock could casting a REALLY wide net, since its likely to include every single IP address used by that organization (and possibly their parent organization group).