Hit-list scanning

Build a hit-list by:
stealthy scans
distributed scanning
dns searches
spiders
public surveys, e.g. netcraft
just listen: vulnerable machines will come to you.

Then divide-and-conquer the list.

Moves from 8 hours to scan 300,000 hosts, to 15 minutes.