http://sharingmyip.com/?site=ycombinator.com
It finds related sub-domains being used, like wiki.ycombinator.com
Or for Cisco: http://sharingmyip.com/?site=cisco.com
It shows that some of their external domains are pointed to internal addresses (in the 10.0 range).