How can I get a listing of domain names registered to a particular company?

The only legitimate way I know of to do this is to ask them and I feel
certain that isn't what you intended with this question.  Several
questions about searching whois by company or individual rather than
the domain name have been asked and no one seems to have discovered a
way to do this yet.

Good luck.

In the UK, our top-level domain registrar (Nominet) operate a database
called the Public Register Subscription Service (PRSS). This is a
restricted access database, available only to Nominet members, which
allows reverse whois lookups (finding a list of domains registered to
a person or company). If the company you want to find will have UK
domains, you might try contacting Nominet (www.nic.uk) for more
information.

The problem with US domains is that the US domain system is, frankly,
a bit of a mess. You have several different top-level registrars, each
of whom can operate their own whois registry, with different amounts
of data, and different ways to use that data. The largest would appear
to be the VeriSign Global Registry at
http://www.verisign-grs.com/whois/ but this does not appear to have
any equivelant of the UK PRSS service.

One other possible thing to try would be if you can find out one
domain that is owned by the company or person in question, you could
then find the IP address that domain resolves to, then use the TLD
Zone File Access scheme at the VeriSign site (available to all but
you'll need to sign a contract before you can access the data) and
search through the zone file for other domains that resolve to the
same IP address within that TLD (there's a file each for .com, .net
and .org). This isn't ideal, however, as if the domain is hosted with
an ISP, this would match every domain on that ISP's particular
webserver.

If they are using the same namesservers on all of those domains (and
the registry that operates the TLDs has a zonefile access program),
you could download the zonefiles and then search for all the names
using those nameservers...

/Frank