What steps would you take to discover all (or close to all) IP addresses that are currently used by a website? How would you be as exhaustive as possible without calling a website admin and asking for the list of IP addresses? ;)

nslookup works but will vary based on dns server queried.

whois is another good tool.

Dig, not bad.

Let's use Facebook for example. I'm blocking that site for the majority our our company's users, but some are approved for "research". I can not easily use OpenDNS because we all appear to come from the same request IP address. I could change that but don't want to add more vlans than I already have.

I also could use block something like regex facebook1 "facebook\.com" (I'm running a cisco firewall) but that's pretty easy to sidestep.

All that being said, I'm asking about specifically about finding ip addresses for a domain and not for other methods that I can block a domain name.