There is a a server I have whose host provides a VPN for customers onto the BMC network. I don't know if they are checking which IP address I access through the VPN, and I don't really want to find out lest I get terminated.

There's another one from a host that just has it open to the internet. I bet you'd find a bunch by scanning the internet.