Remind me of some well-known source MAC addresses?

I've got a project that will benefit from having a list of MAC addresses which are likely to show up in the L2 filter list on any given network.

Put another way, if I challenged you to type a command of the form show mac address-table address <value> on an unfamiliar network and get a hit, what value would you guess with?

So far, I've only thought of the addresses used by HSRP and VRRP.

Are there other well known addresses I should consider?

Making hundreds/thousands of attempts (even walking 4000+ HSRP addresses) is probably going to be okay for my use case, but I'm not interested in blindly groping through Cisco/Juniper/HP/Dell OUIs hoping for a hit.