Subdomain IPs
Historical resolutions of company subdomains to IP addresses, with cloud-provider attribution.
subdomain_ips — the dataset name to pass to the Obscura API.
What one row means
One historical DNS resolution fact for a covered company's web footprint: a single subdomain (discovered via crt.sh certificate-transparency logs for the company's registered domain) paired with one IPv4 address that Mnemonic passive DNS has observed it resolving to, annotated with the cloud provider that IP address belongs to (matched against AWS/GCP/ Cloudflare published ranges) and a not-yet-populated ASN/AS-org attribution slot.
One row per (subdomain, ip).
Point-in-time availability
Every Obscura dataset carries available_date: the calendar day the publisher made the row
available, day-of, with no session rounding. It is the one column a backtest filters on, and it means the
same thing on every dataset in the catalog.
For subdomain_ips: published: available_date = synced_at::date, the day alt_data's own crt.sh + Mnemonic scan observed and upserted this (subdomain, ip) resolution — a snapshot-on-ingest dataset with no native filing/publication calendar behind it.
Refresh cadence
Obscura refreshes subdomain_ips every 6 hours — the most frequent scheduled job that re-collects or re-exports it. This is Obscura's own pipeline cadence, not the upstream publisher's release schedule; when a row became public is recorded per row in available_date.
Schema — 12 columns
The full public column list for subdomain_ips, with the meaning of every field. The same
schema is served unauthenticated at https://api.obscura.trade/v1/catalog/subdomain_ips.
| Column | Type | Description |
|---|---|---|
| subdomain | text · not null | Fully-qualified subdomain hostname (e.g. 'www.grindr.com') enumerated from crt.sh certificate-transparency logs for the covered company's registered domain, with wildcard entries filtered out before resolution. First half of the composite conflict key. |
| ip | text · not null | IPv4 address (dotted-quad text) the subdomain has been observed resolving to, per a Mnemonic passive-DNS A-record answer. Only IPv4 is captured. Second half of the composite conflict key. |
| ticker | text | Equity ticker of the company whose website produced this subdomain, resolved from the company-homepage mapping at scan time. |
| domain | text · not null | The registered (eTLD+1) domain the subdomain belongs to, derived from the ticker's company_site — e.g. 'grindr.com' for subdomain 'www.grindr.com'. This is the unit the task's resumability/dedup keys on, not the subdomain itself. |
| first_seen | date | Mnemonic passive-DNS firstSeenTimestamp for this (subdomain, ip) A-record — the historical day the sensor network first observed the resolution; an observation-window start, not a public-availability date. |
| last_seen | date | Mnemonic passive-DNS lastSeenTimestamp for this (subdomain, ip) A-record — the most recent day the sensor network observed the subdomain still resolving to that IP; the observation-window end. |
| asn | bigint | Autonomous System Number the IP belongs to. Always NULL in the current build — ASN attribution via the iptoasn bulk feed is an unimplemented follow-up. |
| as_org | text | Registered organization name for the IP's ASN (e.g. the hosting/transit provider). Always NULL in the current build for the same reason as `asn`. |
| cloud_provider | text | "aws" | "gcp" | "azure" | "cloudflare" | null (self-hosted / other). Best-effort cloud vendor label for the IP, derived by longest-match against each vendor's published IPv4 CIDR ranges fetched fresh each run. |
| min_ttl | bigint | Minimum DNS record TTL (seconds) Mnemonic observed for this (subdomain, ip) A-record, from `data[].minTtl`. A distinct passive-DNS measurement (not derivable from anything else we keep); very short TTLs can hint at CDN/failover/traffic-steering hosting. |
| max_ttl | bigint | Maximum DNS record TTL (seconds) Mnemonic observed for this (subdomain, ip) A-record, from `data[].maxTtl`. Distinct measurement paired with `min_ttl`. |
| available_date | date | PUBLIC-availability date, DB-generated STORED as `synced_at::date` — the day alt_data itself observed and ingested this (subdomain, ip) resolution. The point-in-time column to filter/join on; NEVER the DNS record's own first/last-seen history. |
Access subdomain_ips
Two delivery paths, one identifier. Both require an Obscura account and an active subscription; the catalog entry and the schema above are public.
import obscura
client = obscura.Client("obs_live_…")
df = client.query(
dataset="subdomain_ips",
symbols=["NVDA", "AAPL"],
start="2024-01-01",
)Create a free account Browse all 95 datasets
Frequently asked questions
What is in the subdomain_ips dataset?
Historical resolutions of company subdomains to IP addresses, with cloud-provider attribution. One historical DNS resolution fact for a covered company's web footprint: a single subdomain (discovered via crt.sh certificate-transparency logs for the company's registered domain) paired with one IPv4 address that Mnemonic passive DNS has observed it resolving to, annotated with the cloud provider that IP address belongs to (matched against AWS/GCP/ Cloudflare published ranges) and a not-yet-populated ASN/AS-org attribution slot.
How do I avoid look-ahead bias with subdomain_ips?
Filter on subdomain_ips.available_date, the day the publisher made the row public. For this dataset that date is derived as follows — published: available_date = synced_at::date, the day alt_data's own crt.sh + Mnemonic scan observed and upserted this (subdomain, ip) resolution — a snapshot-on-ingest dataset with no native filing/publication calendar behind it. A query of the form WHERE available_date <= '<as-of date>' never sees a row before it existed.
In what formats can I get subdomain_ips?
As a Parquet bulk export (POST https://api.obscura.trade/v1/download) or as JSON from the typed query API (POST https://api.obscura.trade/v1/query), both with dataset="subdomain_ips". The column schema is public at https://api.obscura.trade/v1/catalog/subdomain_ips.
Can I filter subdomain_ips by company or symbol?
Yes. subdomain_ips carries ticker, the column the API's symbols filter resolves against.
How often is subdomain_ips updated?
Obscura refreshes subdomain_ips on a every 6 hours schedule — that is the most frequent scheduled job that re-collects or re-exports the table. It is Obscura's own pipeline cadence, not the upstream publisher's release schedule; when the publisher makes a row available is described by the availability rule above, and is recorded per row in available_date.