Entity work that touches China eventually runs into the question of what the official sources actually return to a program, as opposed to a person. I do supplier record checks China-side, so the vantage point below is one that is awkward to get from outside: these are measurements from consumer broadband inside mainland China, not through a proxy.
Two timepoints so far, 9 and 15 August 2026, same instrument each time (fixed 25s timeout, two client identifiers, no redirect following, no retries, front page only, control hosts requested in the same session). Values are curl-UA / browser-UA.
| Source | 9 Aug | 15 Aug |
|---|---|---|
| National company registry | 521 / 521 | 521 / 521 |
| National credit portal | 412 / 412 | 412 / 412 |
| Court judgments | 0 / 200 | 200 / 200 |
| Court enforcement | 0 / 200 | 403 / 200 |
| Trademark office | 403 / 403 | 403 / 403 |
| Customs enterprise credit | 412 / 412 | 412 / 412 |
| National standards | 200 / 200 | 200 / 200 |
| CCC certification | 521 / 521 | 521 / 521 |
| Control: central gov portal | 200 | 200 |
| Control: commercial host | 200 | 200 |
Three things came out of reading the response headers that may save someone time.
The status code does not identify the mechanism. The 412 from the credit portal carries the same protection-vendor fingerprint as the 521 from the company registry: one system, two codes. The 412 from the customs portal is a different product entirely. Sorting failures by status code sorts them wrongly.
Changing the client identifier achieves nothing. Four of the five refusals returned byte-identical headers whether the request announced itself as curl or as a desktop browser.
One request is not a measurement. The court enforcement source returned 403 at one minute and 200 to the same client ten minutes later, nothing changed at my end. That cuts both ways: the 0 recorded for that host on 9 August may equally have been a window rather than a policy.
On attribution, since this is the part I got wrong first. The same run from an offshore exit failed on 7 of 8 targets, which looks like a finding until you check the controls: the government-host control failed too, while the commercial control passed. So that batch says nothing about the targets, the failure is in the link. Without a control host in the same session, a 521 is indistinguishable from a broken route.
No challenge was solved and there is no bypass here. The checks I deliver are read by a person, in the ordinary way, which is also why the empty results stay in them.
Raw observations, CC BY 4.0, including the two wrong conclusions reached before this one: China national company registry JavaScript-challenge observations, 14 August 2026 - Mendeley Data
Disclosure: I sell China-side supplier verification, so I have an obvious interest in this subject. Posting the measurements rather than a summary because they are reproducible without me.