I'm not certain why but it appears search engines often index quite a bit of info from WhoIs records . . SO . . if I'm able to find one WhoIs record I can oftimes do an exact match search that will throw up lots of data about ~related domains.
There there's also things you can do playing with DailyChanges / DNS searches, especially when there are bulk reassignments of DNS. Of course, this requires a bit of vigilence, obsessiveness, etc AND, sometimes, lucky timing (i.e., where some party decides to mass reassign their DNS records).
Any other ideas?