Here's another radio domain to SWL: the SCA subcarriers of FM broadcast radio stations.
As the Kenwood TS440S and SAT and possibly other such rigs can receive signals all the way down to 30KHz all modes (AM, FM, USB, LSB, CW), you can "SWL" the SCA subcarriers on the FM broadcast band. Usually found as FM modulation at 67kHz, 92kHz, and maybe 41KHz (if the station doesn't broadcast stereo) and RDS/EAS at 57kHz (use the FSK demod on the TS440S at about 58 or 59kHz).
What you need to do is tap the output of the main FM carrier detector before the deemphasis circuit in an FM broadcast band radio. A cheapie AM/FM clock radio set will do at first, one with a wide FM IF strip is better, so the sidebands carrying the subcarriers don't get clipped. The deemphasis circuit is usually an RC low pass filter. One way to "hunt" for this point is to hook up an audio amplifier to a test probe, and find a node on the circuit board that has main channel broadcast audio with lots of treble as compared to that found at the top of the volume control. If you can't find such, take a look for a small cap (on the IC pin with the audio demod out) that goes to ground which in combination with a resistor may be the deemphasis network. Try disconnecting the cap. One this spot has been identified, connect a 0.01uF cap in series with a 1K resistor, and that then in turn feeds the center conductor of a length of thin coax. The coax ground connects to the radio ground. The other end of the coax connects to the TS440S antenna input. Check that the FM broadcast radio still plays, as the coax cable is now loaded with 50Ω impedance.
If you have an older mono FM tuner like an Eico HFT90, connect to the multiplex output jack (the one intended to feed an external stereo demodulator) and use a resistor of around half a meg in the signal path from this jack to the TS440S receiver. Or use a cathode follower or emitter follower to lower the impedance without much signal level loss. This will avoid excessive loading of the normal mono output signal (so you can listen for FM stations' main mono audio channels).
Disconnect the mic on the TS440S or other transceiver so you don't accidentally transmit into the FM radio! Tune in 38KHz in USB mode. Now tune around on the FM broadcast radio. You should be able to hear the "difference" (L-R) audio signal of FM stereo stations. You should be able to notice the usual lack of vocals in most songs, as compared to the FM broadcast radio's mono speaker output. Assuming success, try tuning in 67KHz FM mode on the TS440S. Now tune around on the FM broadcast radio. You may find various foreign language programs and data transmissions. Also try 92KHz FM on the TS440S. Expect about 10% of FM broadcast stations to have subcarriers. If you've tried to build the usual SCA decoders using PLL circuits or FM demod chips, you know that crosstalk from the main program material is a big problem, but the TS440S's receiver seems much better handling this problem, as its selectivity and dynamic range is much better. Similar ham transcievers should also work well with this (again, be sure to disable the transmitter). Don't overlook the college radio subband from 88 to 92 MHz.
You're essentially "surfing" the radio spectrum in two dimensions, one "axis" is the FM broadcast band, and the other is each FM station's subcarrier signal spectrum.