You cannot use IP in sfuzzer, since it tries subdomains from dictionary and checks which of them are running. But you can use osintscan (since using search engines you might discover the connection between IP and domain) and go from there.
