Most non-governmental websites are *not* completely accessible. In a sense, any website that does not meet the criteria for a compliant website could be a target. In fact, in most cases, unless "Section 508 compliance" was listed as a project requirement, most websites out there are not compliant, and therefore a potential target.