Study measures how China's company registry grades access by browser fingerprint, not just location

A supplier verification company has spent months running structured experiments against China's national company registry and published the results, along with 20 openly licensed datasets, so that others can check the work. In a technical writeup on dev.to, Derrick Zhou of Currawong Web describes a system that does not treat all visitors equally: the registry appears to score clients by browser fingerprint and hand out graded responses accordingly.

A registry that grades its visitors

According to the writeup, the registry, known as NECIPS (国家企业信用信息公示系统), is the authoritative record of business registrations across roughly 160 million records, holding licence details, legal representatives, registered capital and operational status. In the absence of a public API, it also confronts every arriving request with a JavaScript challenge. Zhou's account of the mechanism: the first response is a bare HTML shell containing an inline script; the script inspects environment properties that differ between headless and headed browsers; a pass sets a cookie and reloads the page with real content; a fail produces either a reload loop or an empty payload, served with a normal 200 status and no error message. Notably, the same IP address saw different outcomes depending on fingerprint configuration, which the authors read as evidence of multiple trust levels. Some client profiles cleared the challenge yet still received diminished results.

How the experiments were run

Rather than relying on anecdotes, Currawong Web built a paired-control matrix. Five browser fingerprint configurations, ranging from a stock Chrome profile to headless setups, were combined with three entry routes — direct URL, search-engine referral and portal navigation — and tested from two mainland Chinese networks plus one overseas vantage point. Each combination ran three rounds against the same target company, logging HTTP status, challenge presence, data payload presence and response time. Every session also queried a domestic portal known to be reachable, which served as the control condition. The team deliberately declined to publish circumvention techniques, arguing that doing so would weaken a legitimate anti-scraping defence.

What the measurements showed

Across a 106-company lookup set using English names, end-to-end success was low, but the dominant failure point was name matching rather than access. Client profile turned out to matter more than geography: a well-configured browser outside China outperformed a poorly configured one inside it. A separate sweep of eight official certification registries, including CCC, CQC and CFDA sources, accumulated 240 observations and found sharp differences between them. Some respond reliably from any location, while others are effectively unreachable without a session originating in China.

Registry data shifts faster than expected

One dataset followed 264 manufacturers listed as national "Little Giant" (专精特新"小巨人") firms, comparing registration snapshots over time. Fields such as operational status, registered capital and business scope changed more often than typical due-diligence processes assume, meaning a supplier check from six months earlier may already be out of date. The authors frame this not as poor data quality but as a natural property of a live registry, and argue that verification tooling needs to model data freshness instead of relying on cached snapshots.

Two platforms, two identities

For 94 companies present on both Alibaba.com and its domestic counterpart 1688.com, registered names, addresses and representative details did not always line up. The writeup attributes this to legitimate differences in how firms present themselves to international versus domestic buyers rather than to fraud. The consequence lands on entity resolution: matching a supplier's profile against the government registry via an English trade name produces a different outcome than matching via the Chinese registered name.

Why it matters

Most guidance about querying government databases without APIs is anecdotal. This is a rare case of the problem being measured systematically, with a published method, control conditions and reusable datasets carrying DOIs and Creative Commons licences on Harvard Dataverse. The general lessons transfer well beyond China: measure access instead of assuming it, design for graded failure modes because an empty 200 response is harder to handle than a 403, treat browser fingerprints as a first-class variable, and keep verification fresh rather than treating any check as a settled fact.