I'm not certain why but it appears search engines often index quite a bit of info from WhoIs records . . SO . . if I'm able to find one WhoIs record I can oftimes do an exact match search that will throw up lots of data about ~related domains.
There there's also things you can do playing with DailyChanges / DNS searches, especially when there are bulk reassignments of DNS. Of course, this requires a bit of vigilence, obsessiveness, etc AND, sometimes, lucky timing (i.e., where some party decides to mass reassign their DNS records).
i would also consider other methods of search that may more easily expose commonalities in a set of domains that may have some overlap with contact info. for example it is easier to find domains sharing a host, an IP address, a vanity-named DNS server, etc.