Several years ago when I was still doing ISP stuff, it was possible to retrieve *your* domains from a given registrar. They intentionally didn't give you a way to find someone elses domains. You were sometimes able to work around this by managing to get the .com domain dump (all domains on the Internet) and looking for things with common nameservers. This isn't normally available to end-users, but someone else may make it available now.