As you might guess I have done a bunch of diferent things in this area. What I tend to find which is highly effective is to take access logs from large websites of 100,000+ users/day and scanning those ip's for Proxies. Although this generally leads to some nice results however it's not really an option for most people.

I even use to scrape statistic tracker sites for lists of IP's and I currently run several email accounts purely for Spam which with over 10,000 spam emails/day I generally get around 50 working non RBL listed Socks.

Plain old sequential scanning has also had nice results for me too. I just currently don't have time to setup another box for the purpose while I am in Chicago.

I have considered making a distributed scanner, however I don't think it would be something many users would be interested in.