ctscout research · note 1 · v2

Who Is Behind a Domain?

Public certificate data from 2026-02 to 2026-08, checked against the public company registry, to answer one question: when a certificate names an organization, can that name be tied to a legal entity, and is that entity the one behind the domain?

ctscout.dev · warehouse 2026-02 to 2026-08 · GLEIF snapshot 2026-09-06 · Wikidata fetched 2026-09-06

What was measured

Where the data comes from. Every certificate a browser trusts is published to public, append-only ledgers called Certificate Transparency logs. Our collector follows every active log shard of the five operators that matter (between 21 and 27 shards in any month of the period). Because browsers require each certificate to be in at least two logs, this is close to the full public stream, not a sample.

What we keep. Most certificates only prove control of a domain and carry no organization name; we drop them at ingest. We keep the ones where a certificate authority verified a legal organization and wrote its name into the certificate (organization-validated and extended-validation). Each is reduced to one row per organization name and registrable domain (example.co.uk, not mail.example.co.uk). From 2026-02 to 2026-08 that is 586,559 organization-to-domain pairs, 198,346 distinct organization names and 517,856 domains; 50,473 to 64,782 distinct organizations are seen in any single full month.

What "matches" means. A certificate name and a registered name match when they are the same after normalization: lowercase, accents folded to base letters, punctuation removed, and the legal form (Inc., GmbH, 株式会社, (주), S.A. and every other form in GLEIF's legal-form list) stripped from the ends of the name, with two small sets removed wherever they occur: a handful of universal tokens such as inc and ltd, and the forms of scripts written without spaces (detailed under 'What closed the gap'). The registry is GLEIF, which publishes every Legal Entity Identifier (LEI) with its legal name, its other registered names (including transliterations), and who owns whom. Ground truth is Wikidata: 22,518 entities that record both an LEI and an official website. Both are public domain. Two caveats: the ground truth favours large, listed and financial companies, and countries where small firms register an LEI.

Names in other scripts

37,202 of the 198,346 certificate organizations (18.8%) write their name in a script other than Latin, 36,308 of them (18.3%) in Chinese or Japanese characters. A normalizer built on [a-z0-9] reduces nearly every one of them to an empty string, and nothing downstream complains: an empty string simply never matches. The first version of these scripts did exactly that. Every figure below is measured per script, with the same exact-name join as the rest of the note, after the country check described under 'Country consistency at join time'.

script_matching.py · "exact match" = normalized certificate name equals a normalized active GLEIF legal or other name and is assigned to one LEI after the country check (either only one active LEI carries the name, or the country check settles which of several) · 2026-09-06 18:01 UTC

9 of the 198,346 names normalize to nothing at all (a bare legal form, or only punctuation); they sit in their script's row and match nothing. The count is a tripwire: the build refuses to render above 19, one in ten thousand, because the last time it climbed it was the normalizer, not the data.

What closed the gap

• GLEIF's other registered names, including transliterations. A Chinese, Korean or Russian entity's LEI record usually carries its Latin trading name and sometimes the reverse. 15 Chinese or Japanese certificate names and 4,261 Latin ones match only through such an other name. On the ground truth the effect is larger: of 373 matched Chinese and Japanese owners, 270 match through an other name rather than the legal name; for Korean owners 26 of 35; for Hebrew 18 of 18.
• The legal-form table in every language. Legal forms are not typed by hand: they are generated from GLEIF's Entity Legal Form code list (2026-02-19), which carries each jurisdiction's forms in its own script. That is why 有限公司, 株式会社 and 주식회사 disappear from the normalized names in the cases below exactly as Inc. and GmbH do. Multi-word forms are stripped only at the ends of a name. Two small sets are removed wherever they occur: 32 universal tokens (inc, ltd, gmbh, co, company, corporation and the like) and 149 legal forms from scripts written without spaces (Chinese, Japanese, Thai, Burmese and Khmer forms, full phrases as well as abbreviations such as ㈱), which are removed from anywhere in the string because there is no word boundary to anchor them; a name made only of those normalizes to nothing and is counted under the empty-name bound above, while a whole edge phrase such as Limited Liability Company keeps its last token.
• Korean syllables composed back. Folding accents uses Unicode compatibility decomposition, which also splits every Hangul syllable into its letters; (주) then never matched its legal form and Korean output was unreadable. The normalizer composes the syllables back after folding, so 주식회사 is seen and stripped.
• Full-width letters folded. 3,908 of the 36,308 Chinese and Japanese names (10.8%) contain full-width ASCII (ＦＵＪＩ, （）); the same decomposition folds them to ASCII, so "株式会社ＦＵＪＩ" and "株式会社FUJI" are one name. Those names still match at only 5.1%, against 7.2% for Chinese or Japanese names without kana (the group may still contain Latin or other letters). The ㈱-style abbreviation of 株式会社 occurs in 0 certificate names.
• Traditional and simplified characters: measured, not yet folded. 3,223 of 33,355 Chinese or Japanese names without kana contain a traditional form, and 13,559 of 117,172 active GLEIF names in those scripts do. Folding traditional to simplified with a 293-character table would recover 6 currently unmatched names, 6 of them to a single LEI (the rest to a name several LEIs share). The fold is a probe in script_matching.py; it is not in the normalizer, because the gain is small and a Japanese kanji-only name would fold with it.

script_matching.py · names the traditional-to-simplified fold would recover · 2026-09-06 18:01 UTC

Cases

One matched and one unmatched name per script where one exists (a script with no matched name shows only the unmatched case, and a script with no organizations shows none), the largest certificate holders first. "After normalization" is what the join compares; for an unmatched name, the last column is the nearest GLEIF name in its block (same first token, or first two characters for names without spaces), which shows how far the miss is.

script_matching.py · 2026-09-06 18:01 UTC

The residual

In the warehouse, Chinese and Japanese names tie to an LEI at 7.0% and Latin names at 24.5%. The ground truth is the only place to ask why. Here "matches" is broader than in the first chart: any certificate organization on the owner's site, in any script, that normalizes to the owner's legal name, one of its other registered names, or its Wikidata label. On that definition, where the entity is known to have an LEI its name matches more often in Chinese and Japanese than in Latin: 436 of 574 Chinese and Japanese owners (76%) have their site in the warehouse and 86% of those are matched, against 39% and 61% for the 21,611 Latin-named owners. That is consistent with the warehouse gap being the share of organizations that hold an LEI at all, not the matcher; it cannot separate registry coverage from company size, since the ground truth skews to large listed entities in every script.

script_matching.py · ground truth cut by the script of the GLEIF legal name · 2026-09-06 18:01 UTC

A second check points the same way, with a weaker unit: the domain, not the entity. 1,889 of the 43,773 domains that carry a Chinese or Japanese certificate name also carry a Latin one. Often that is the same company's English name, but the check does not verify it (the two names are not linked through an LEI, and a shared domain can carry unrelated organizations), so read the counts as co-occurrence on a domain: on 286 of those domains a name in each script matches an LEI, on 322 only a native-script name does, on 235 only a Latin name does, and on 1,046 neither. On this evidence the native script is not the weak side.

Why matching is hard

Normalization is not where the difficulty lives: lowercasing, punctuation and legal forms take 198,346 raw certificate strings down to 182,828, a 7.8% reduction. The difficulty is that a certificate names whoever requested it, and that registered names are shared. Of the 9,010 ground-truth sites in the warehouse, 2,650 carry no certificate name that equals or contains the owner's registered name: registered-name disagreements, not proof that another organization is behind the site (129 of them carry the owner's common name and 1 its acronym). Each of those pairs is assigned the first category below that fires, from most to least specific; conclusions about who is behind the domain belong to the categories, not to the total.

Each category, defined, with one case (chosen by LEI order so the selection is fixed run to run):

differs_decomposition.py · 2026-09-06 18:01 UTC

The three largest such certifiers, with the ground-truth sites they certify and the number of domains they certify across the whole warehouse (candidates by fan-out; note 2 tests such certifiers with DNS, this table does not):

differs_decomposition.py · 2026-09-06 18:01 UTC

Shared names

The other half of the difficulty is that a registered name is not an identity. In GLEIF, 87,786 normalized names are shared by two or more active entities. In the warehouse, 7,117 certificate organizations match a GLEIF name exactly that several active entities share and cannot be assigned to one LEI (a further 261 match a single entity that the country check contradicts and are set aside for that reason, not because the name is shared). Ambiguity is an outcome the page carries, not one it resolves by picking the first row.

gleif_join.py · 2026-09-06 17:58 UTC

Why GLEIF, and what did not work

GLEIF is the one registry that is free, published daily, global, and carries three things a name match needs: other registered names and transliterations, the ownership hierarchy, and the legal-form list in every jurisdiction's language. Matching the 198,346 certificate organizations against its 3,624,104 active names ties 49,511 (25.0%) to a registered name, 4,380 of them only through an other name, and 8,451 of them to a name several entities share (the country check below settles 1,334 of those and sets 261 single-entity matches aside, leaving 7,378 that cannot be assigned to one LEI). Fuzzy matching of the 140,579 distinct normalized names that stage 1 left unmatched (several certificate organizations can share one normalized name), blocked on the first token and scored with a token-order-insensitive ratio, ties 2,303 more organizations to an LEI at a score of 90 or above after the country check (234 more organizations are ambiguous at that score). The threshold was set on a probe: withhold the exact match for 400 ground-truth names and ask the fuzzy stage to recover the known LEI. The best candidate is right for 286 of 400 at threshold 80, 180 at 90 and 116 at 95; a lower threshold recovers more, but the probe cases below show the best candidate being the wrong LEI even at a score of 100, so 90 is kept and nothing below it is persisted.

Fuzzy matches kept at the operating threshold, sampled across the score range:

What the probe sees, right and wrong. The input is the raw certificate name with punctuation stripped and legal forms kept; the probe knows the true LEI from the ground truth:

gleif_join.py · 2026-09-06 17:58 UTC

Blocking on the first token was measured rather than assumed: on the same probe, comparing against every GLEIF name instead recovers 302 right answers at threshold 80 where blocking recovers 286, and 119 against 116 at 95: 16 and 3 more of the 400. The blocked pass over the warehouse takes 9 seconds on a CPU, so the all-pairs pass was not built.

What we tried that failed

Country consistency at join time

Stripping legal forms equates names across countries: a Japanese 株式会社 and a German GmbH with the same trading name normalize to the same string, and a Korean Co., Ltd. matches a Dutch B.V. (the first demoted case below). The normalizer cannot tell them apart, so the join asks the evidence it already has, all public and deterministic: the share of the organization's domains under one country-code TLD, the script of its name (kana points to Japan, Hangul to Korea), and the GLEIF country of other organizations already resolved on the same domains. A name matching LEIs in several countries resolves to the one whose country the evidence supports; a single-LEI match whose country the demoting evidence contradicts is set aside as ambiguous (evidence from other organizations on the same domains supports a candidate but never demotes one, and a single country-code domain does not either). Registration hubs (Bermuda, the Caymans and the like) are never contradicted: such a holding runs its business and its domains from somewhere else.

Before the rule, 41,060 exact matches named one LEI and 8,451 named several (7,302 across several countries, 1,149 within one country, which no country signal can split). The rule resolved 1,334 of the 8,451 ambiguous names (15.8%): 1,043 by the country code of its domains, 213 by other organizations on the same domains, 66 by the country code of its domains and other organizations on the same domains, 9 by the script of its name, 2 by the country code of its domains and the script of its name, 1 by other organizations on the same domains and the script of its name. It demoted 261 of the 41,060 single-LEI matches (0.64%): 236 on domain evidence and 26 on script, a name possibly carrying both. 1,757 single-LEI matches were kept although no evidence names their country, 50 of them because the LEI sits in a registration hub. Among fuzzy matches it resolved 4 and demoted 67. After the rule: 42,133 unique, 7,378 ambiguous.

What the rule rejects, checked against the ground truth

A rule checked only on what it resolves is unchecked, so its rejections and its picks are measured against the ground truth on every run. What can be measured is how many known-correct candidates the rule rejects (recall lost on the ground truth), not what share of its demotions are wrong: that would need labelled demotions, which do not exist. Of 6,182 exact-name candidates that are the owner's own LEI, the rule marks 24 (0.39%) unsupported, 16 of them as contradicted; 15 ground-truth pairs lose every exact match to it. Of 225 country picks where the owner's LEI was among the name's candidates, 215 (95.6%) picked it and 10 picked another LEI.

Cases

Resolved by country: the name matches LEIs in two countries and the organization's own evidence picks one.

Demoted: the only LEI with that name sits in a country the organization's evidence contradicts, so the match is set aside as ambiguous rather than kept. Whether each demotion is right cannot be read from the name: a company whose only certified domains sit under a foreign country code (the second row) may still be the entity the certificate names, and the ground-truth check above measures how many known-correct candidates the rule rejects, not how many of its demotions are wrong.

gleif_join.py · 2026-09-06 17:58 UTC

What this can and cannot say

• It can say which certificate names tie to exactly one legal entity (44,436 of 198,346), how that varies by script, and, for entities with a known website, how often the certificate carries the owner's registered name (58% of the 9,010 present; 71% counting containment) against a name that passes neither check.
• It cannot say anything about the 60% of ground-truth pairs whose site had no organization-validated certificate logged in the period, nor which LEI a shared name belongs to (7,117 exact-name and 167 fuzzy matches shared by several entities after the country check), nor whether the 261 exact and 67 fuzzy matches set aside because their only entity sits in a country the organization's own evidence contradicts were right to set aside, nor whether a demoted match was wrong beyond the ground-truth check above, which counts known-correct candidates the rule rejects and does not measure how many demotions are wrong.
• The ground truth is skewed to large, listed and financial entities and to countries where small firms register an LEI; the per-country and per-script rates are rates on that set, not on the economy.
• Open. The traditional-to-simplified fold would recover 6 names and is not applied; the German digraph second key is tracked, not built. Remaining normalizer gaps (equivalence classes such as "Co Ltd" vs "Corporation", other transliteration schemes, multi-script names) are tracked, not fixed. The warehouse-wide share of domains carrying only a vendor's certificate is the next number this note should carry; note 2 measures the vendors themselves.