OK, it turns out Mike Ballon's example won't work.

Let me try to re-phrase the question:

I have this rogue ISP/Webhost/Webdesign company - call 'em "badguycorp".  I
don't want to say their name.  They are hosting websites that are legally
and/or morally questionable.

I want to find those websites.

I have half a dozen or so known example domains that "badguycorp" is
hosting/running.  Looking at their whois data, I know that the main point
of commonality is the name servers.  All of them end in badguycorp.net -
with different stuff preceding those.  For example:

ns3.tre.badguycorp.net
ns2.fds.badguycorp.net
ns1.jhg.badguycorp.net

So.  What I need to do is trawl for whois entries where the name server(s)
end in "badguycorp.net", and report what those websites are.

Is there a way to do this, by any method, Linux command line or otherwise?

Thanks!

Jim