This stuff is very common. The easiest way to find it is to locate infrastructure associated with one homology (nameservers, or IP addresses of nameservers or hosting) and then see what other domains are on those servers / hosting, assuming you have access to a crowdsourced Passive DNS database.
(Crowdsourced in this case is important, and I draw a distinction because most commercial PDNS DBs are crowdsourced, and I offer free software which synthesizes PTR records from locally observed PDNS because it serves a different purpose.)