The same registry gave us six different answers.

Before treating an empty result as evidence

Confirm the entry point and client first. The measurements below show why that step belongs before any decision about the supplier.

Root path only, three rounds each, all from the same host inside mainland China in one session, all sending a Chrome user-agent string. No search was run, no record was retrieved, and no redirect was followed.

Entry points are only as useful as their availability. Five of the eight official hosts measured here refused their front page on the test date. The two that answered, court judgments and national standards, are also the two least often quoted in supplier due diligence.

Six official doors into one system, and no two behaved the same way. Three of the six returned something a monitoring script would classify as failure. One returned success, one returned a redirect, and one returned a status that usually means the resource does not exist.

The provincial door answers

The result that changes the practical picture is the Shandong provincial entry: 200 on all three rounds, to a plain scripted client. The national front page refused the same class of client on every one of five progressively more browser-like profiles, but this provincial entry did not refuse it at all.

That does not mean provincial entries are a way around anything, and we are not presenting it as one. Different entry points into a federated system are operated separately and expose different things. A 200 on a root path says the door opened. It does not say the data behind it is equivalent, complete, or that a query would succeed. We requested root paths and stopped there.

What it does mean is narrower and more useful: a statement like “the Chinese registry blocks automated access” is too coarse to be true or false. It depends entirely on which of at least six doors is meant.

How a control host exposed our wrong conclusion

Earlier the same day we recorded that one of our control hosts had returned 403 where a previous run recorded 200. We wrote that down as the host drifting between dates. That was wrong, and this measurement is what caught it.

Repeating the request five times under each of two client profiles gave a completely stable split. Bare requests returned 403 on all five rounds. Requests sending nothing more than a Chrome user-agent string returned 200 on all five. Nothing had drifted. Two runs had simply used different clients, and we had compared them as if they were the same measurement.

The lesson generalises past our own mistake. A control host exists to tell you that your network and your method are working, so that a failure at the target means something. But a control that discriminates on client shape cannot do that job unless you state the shape. “The control returned 200” is not a fact on its own. Any availability panel that omits its client profile is under-specified. That includes some of our earlier panels, which we are reviewing.

Of the hosts here, only the central government portal answered 200 to every profile on every round. That is what makes it usable as a control, and it is the one we will keep using.

Why this matters if you are buying from China

Two practical consequences, both about how to read someone else's claim.

When a tool or a vendor tells you an official source is unavailable, the useful question is which entry point they tried and with what client. On this evidence, the honest answer to “can it be reached?” ranges from 200 to 521 depending on the door. A check pointed at a single one is not measuring the system.

When a supplier check comes back empty, the same caution applies in the other direction. A nil result that came through a door returning 404 or 400 tells you about the door, not about the company.

Our own answer stays the same as it was: the checks are executed China-side by a person. Each delivered line carries the source it came from and the date it was retrieved, including when the answer is that nothing was found. You can see what that produces on a real named company.

Before blaming the door, pin down the key you are searching with. A wrong code or an approximate name produces a confident-looking miss at any of these entry points, and that half is yours to rule out first. Check the 18-character code offline → A transcription error shows up immediately, in your browser, before it becomes the wrong company. Find candidate registered names from the English name → Free, for when the registered Chinese name is the missing piece. Neither one queries the entry points compared above.

Related: five client profiles against the national front page · the original challenge measurement · the eight-source availability panel · how to search the registry once you are in.

Six doors, and what is on the other side of any of them

This study compares six official entry points and finds six different answers. None of that describes the record itself. On 21–22 August 2026 I queried nineteen dimensions for 45 Chinese manufacturers through a licensed commercial route, the companies on the NHTSA vehicle-manufacturer list resolving to exactly one Chinese entity.

Which door you knock on changes whether you get in. It does not change what is inside. The variation this study documents is in access, and the content behind it is consistent enough to be worth the trouble of reaching.

Two limits on reading this as a substitute. It is a different kind of access. It does not get around what this study measured. The zero row shows what no route can improve on: an empty sanction record is the ordinary state, so passing that check distinguishes nobody. The batch is described in the NHTSA manufacturer study and is read along different dimensions across this site.

Citing this

Archived copies, each with its own DOI, resolving independently of this site: Zenodo · Harvard Dataverse.

Quote or reproduce these results freely, including commercially, provided you keep the date (15 August 2026), the vantage (one cloud host inside mainland China), the client profile (a scripted client sending a browser user-agent string) and the stated limits travel with them. On this page the client profile is not a footnote. It is the finding.

Currawong, “Six official entry points to China's company registry, six different answers”, three-round root-path observations from one mainland Chinese host with same-session controls, 15 August 2026. https://currawongweb.com/verify/china-registry-entry-points/

@dataset{currawong_china_registry_entry_points_2026,
  author    = {Bao L. Zhou},
  title     = {{China company registry entry-point matrix: six official doors, three rounds each}},
  year      = {2026},
  publisher = {Zenodo},
  doi       = {10.5281/zenodo.22004818},
  url       = {https://doi.org/10.5281/zenodo.22004818}
}

Machine-readable evidence, every door and round: the observation table (CSV, CC BY). It carries the entry point, its tier, the client profile, the per-round status codes and the two-profile control rows. The page states the finding, the file lets you check it.

If you re-run this from another network or date and see something different, we want to hear it. Corrections that survive checking get published here with attribution, including ones that contradict us. Browse all measured studies and methods in the research index.

This page reports connectivity observations on root paths. It is not legal advice, it is not a statement about any company, it is not a route around any access control. It is not a claim about what data any entry point exposes.