# A comparison of subdomain discovery capabilities

Subdomain discovery is an essential part of recon and some services provide it as a feature.

- [Shodan](https://www.shodan.io/)
- [SecurityTrails](https://securitytrails.com/)
- [RiskIQ(PassiveTotal)](https://www.riskiq.com/)
- [Spyse(FindSubdomains)](https://spyse.com/)

Which one is better? Let's do a comparison!

## Targets

In this comparison, I'll use the domains of Fortune 10 as samples because I assume that big companies have a large number of domains.

| Rank | Name | Domain |
|------|--------------------------|-----------------------|
| 1 | Walmart | walmart.com |
| 2 | State Grid | sgcc.com.cn |
| 3 | Sinopec Group | sinopecgroup.com |
| 4 | China National Petroleum | cnpc.com.cn |
| 5 | Royal Dutch Shell | shell.com |
| 6 | Toyota Motor | toyota.com |
| 7 | Volkswagen | vw.com |
| 8 | BP | bp.com |
| 9 | Exxon Mobil | exxonmobil.com |
| 10 | Berkshire Hathaway | berkshirehathaway.com |

## Comparison

| domain | Shodan | SecurityTrails | RiskIQ(PassiveTotal) | Spyse(FindSubdomains) |
|-----------------------|--------|----------------|----------------------|-----------------------|
| walmart.com | 348 | 1,250 | 1,004 | 2,396 |
| sgcc.com.cn | 160 | 355 | 473 | 189 |
| sinopecgroup.com | 1 | 2 | 3 | 3 |
| cnpc.com.cn | 167 | 165 | 277 | 76 |
| shell.com | 532 | 1,402 | 1,623 | 2,475 |
| toyota.com | 483 | 1,500 | 825 | 2,566 |
| vw.com | 153 | 280 | 319 | 272 |
| bp.com | 220 | 925 | 715 | 840 |
| exxonmobil.com | 302 | 968 | 666 | 968 |
| berkshirehathaway.com | 4 | 10 | 1,364 | 1 |

Note: The numbers in this table mean a number of subdomains which discovered by the service.

| Service | Total number of subdomains discovered |
|-----------------------|---------------------------------------|
| Shodan | 2,370 |
| SecurityTrails | 6,857 |
| RiskIQ(PassiveTotal) | 7,269 |
| Spyse(FindSubdomains) | 9,786 |

## Conclusion

In this comparison, Spyse(FindSubdomains) achieved the best results.

But, if you want to get truly the best results, you should combine all of them.