Maidsafe didn’t reply to the OP, but this is understandable because the answer could have been used by an attacker to spam the nodes.
I found by myself another message (MessageContent::RoutingTableRequest) that I could use to get the list of node ids for test networks 12c, 15 and 16. I used it to compute dynamic data of safe://galaxy and then safe://constellations(2) sites. My program sent about 20 messages of this kind per minute, so I hope I didn’t abuse of this message.
Now I can reveal it because, in turn, this message has been suppressed from current master routing repository and test16 has been shut down.
I don’t know if I will find another trick to get the list of node ids for next test network, so maybe safe://constellations2 was the last of this kind of sites (at least from me).