Good question. But some clients (like Damus) send the list of relays you subscribe to. So maybe we can guess a list of potential relays from this.