Speaking from personal experience, besides standard VM/NIC assigned IP's it would be so amazing if this could pull all the other endpoints that are publicly available and allow for misconfiguration. These are the examples that come to mind.
AWS:
Azure:
- Blob Endpoints
- AKS Management API Endpoints
- Service Fabric Cluster Explorer Endpoints
- Traffic Manager Endpoints
- PaaS Database Endpoints(Redis, MySQL, Postgres, etc)
- APIM Endpoints (Developer portal URL & Gateway URL)
- Enterprise Applications (Homepage URL's)