There is an another service you can use to enumerate subdomains called the Domain API from Web Shrinker (https://www.webshrinker.com/website-domain-api/). That API provides you with any subdomains that have been seen while crawling the web. You could even use it to reverse an IP address to it’s most likely web site.
Full disclosure: I’m the founder of Web Shrinker. I don’t engage in shameless self-promotion but it’s an extra tool you could use to gather additional information. Great fit for your use case.