Some companies, such as GoDaddy have access to DNS zone files - this is the then resold to even more companies. Look at my reply to this article to see where you can get a list for free.