I thought services like snapnames covered all the registrars, or at least the major ones?
Yep, the likes of Snapnames and Pool have a base of loads of different registrars in order to use their shared registry service connection threads. ICANN registrars only contract with one dropcatching company though (as far as i'm aware these days) so ultimately when the domain does drop it will reside with just one ICANN registrar who may happen to be under contract to Snapnames or Pool or even a lone registrar catcher themselves.