It looks like Microsoft has silently killed off PassiveTotal/RiskIQ. api.passivetotal.org no longer hosts the API.

https://x.com/00001B1A/status/1879376037370568952
https://x.com/fillagrew/status/1880313088358170807
https://x.com/im23pds/status/1877919449740918895
https://x.com/ajigonomi/status/1876918624025256009

It was integrated into Microsoft Defender Threat Intelligence but I'm not sure if it provides data usable for subdomain enumeration.

https://www.microsoft.com/en-us/security/business/siem-and-xdr/microsoft-defender-threat-intelligence