Topology-based scanning

Morris worm did this
it needed to, because of the sparse address space

p2p networks: instant peer lists.
(aim buffer-overflow story)

if you hit web clients, go through their cache for a list of web servers