[toast0]

I wrote a script to scrape whois, and then send mail to hostmaster@internic spoofing the admin address to change nameserver addresses.

I only used it for legitimate customers due to a hostname rename (in retrospect, we should have just kept the old hostname...), but it worked on like 95% of our customer domains and probably would have worked for lots more. You could setup authentication for internic, but it was optional, and clumsy, so most people didn't.