Scanning only needs to know the potential ips, not the active ones.

And you might be interested in the ip space of all UK entities.

If you put it this way then the problem becomes way easier. Just check public ip databases for AS and technical contact.

Within IPv4 address space you can certainly do it in a day using $100 dedicated server on Hetzner and ZMap.

In my case it was out-of-country website with a local TLD.