ctscout research · note 1 · v2

Who Is Behind a Domain?

Public certificate data from 2026-02 to 2026-09, checked against the public company registry, to answer one question: when a certificate names an organization, can that name be tied to a legal entity, and is that entity the one behind the domain?

ctscout.dev · warehouse 2026-02 to 2026-09 · GLEIF snapshot 2026-10-25 · Wikidata fetched 2026-10-25

What was measured

Where the data comes from. Every certificate a browser trusts is published to public, append-only ledgers called Certificate Transparency logs. Our collector follows every active log shard of the five operators that matter (between 21 and 42 shards in any month of the period). Because browsers require each certificate to be in at least two logs, this is close to the full public stream, not a sample.

What we keep. Most certificates only prove control of a domain and carry no organization name; we drop them at ingest. We keep the ones where a certificate authority verified a legal organization and wrote its name into the certificate (organization-validated and extended-validation). Each is reduced to one row per organization name and registrable domain (example.co.uk, not mail.example.co.uk). From 2026-02 to 2026-09 that is 676,831 organization-to-domain pairs, 230,814 distinct organization names and 591,423 domains; 50,473 to 80,028 distinct organizations are seen in any single full month.

What "matches" means. A certificate name and a registered name match when they are the same after normalization: lowercase, accents folded to base letters, punctuation removed, and the legal form (Inc., GmbH, 株式会社, (주), S.A. and every other form in GLEIF's legal-form list) stripped from the ends of the name, with two small sets removed wherever they occur: a handful of universal tokens such as inc and ltd, and the forms of scripts written without spaces (detailed under 'What closed the gap'). The registry is GLEIF, which publishes every Legal Entity Identifier (LEI) with its legal name, its other registered names (including transliterations), and who owns whom. Ground truth is Wikidata: 22,707 entities that record both an LEI and an official website. Both are public domain. Two caveats: the ground truth favours large, listed and financial companies, and countries where small firms register an LEI.

Names in other scripts

44,108 of the 230,814 certificate organizations (19.1%) write their name in a script other than Latin, 43,069 of them (18.7%) in Chinese or Japanese characters. A normalizer built on [a-z0-9] reduces nearly every one of them to an empty string, and nothing downstream complains: an empty string simply never matches. The first version of these scripts did exactly that. Every figure below is measured per script, with the same exact-name join as the rest of the note, after the country check described under 'Country consistency at join time'.

script_matching.py · "exact match" = normalized certificate name equals a normalized active GLEIF legal or other name and is assigned to one LEI after the country check (either only one active LEI carries the name, or the country check settles which of several) · 2026-10-25 09:35 UTC

10 of the 230,814 names normalize to nothing at all (a bare legal form, or only punctuation); they sit in their script's row and match nothing. The count is a tripwire: the build refuses to render above 23, one in ten thousand, because the last time it climbed it was the normalizer, not the data.

What closed the gap

• GLEIF's other registered names, including transliterations. A Chinese, Korean or Russian entity's LEI record usually carries its Latin trading name and sometimes the reverse. 22 Chinese or Japanese certificate names and 4,856 Latin ones match only through such an other name. On the ground truth the effect is larger: of 388 matched Chinese and Japanese owners, 278 match through an other name rather than the legal name; for Korean owners 27 of 36; for Hebrew 19 of 19.
• The legal-form table in every language. Legal forms are not typed by hand: they are generated from GLEIF's Entity Legal Form code list (2026-02-19), which carries each jurisdiction's forms in its own script. That is why 有限公司, 株式会社 and 주식회사 disappear from the normalized names in the cases below exactly as Inc. and GmbH do. Multi-word forms are stripped only at the ends of a name. Two small sets are removed wherever they occur: 32 universal tokens (inc, ltd, gmbh, co, company, corporation and the like) and 149 legal forms from scripts written without spaces (Chinese, Japanese, Thai, Burmese and Khmer forms, full phrases as well as abbreviations such as ㈱), which are removed from anywhere in the string because there is no word boundary to anchor them; a name made only of those normalizes to nothing and is counted under the empty-name bound above, while a whole edge phrase such as Limited Liability Company keeps its last token.
• Korean syllables composed back. Folding accents uses Unicode compatibility decomposition, which also splits every Hangul syllable into its letters; (주) then never matched its legal form and Korean output was unreadable. The normalizer composes the syllables back after folding, so 주식회사 is seen and stripped.
• Full-width letters folded. 4,674 of the 43,069 Chinese and Japanese names (10.9%) contain full-width ASCII (ＦＵＪＩ, （）); the same decomposition folds them to ASCII, so "株式会社ＦＵＪＩ" and "株式会社FUJI" are one name. Those names still match at only 4.9%, against 7.1% for Chinese or Japanese names without kana (the group may still contain Latin or other letters). The ㈱-style abbreviation of 株式会社 occurs in 0 certificate names.
• Traditional and simplified characters: measured, not yet folded. 3,492 of 39,749 Chinese or Japanese names without kana contain a traditional form, and 13,620 of 117,208 active GLEIF names in those scripts do. Folding traditional to simplified with a 293-character table would recover 8 currently unmatched names, 8 of them to a single LEI (the rest to a name several LEIs share). The fold is a probe in script_matching.py; it is not in the normalizer, because the gain is small and a Japanese kanji-only name would fold with it.

script_matching.py · names the traditional-to-simplified fold would recover · 2026-10-25 09:35 UTC

Cases

One matched and one unmatched name per script where one exists (a script with no matched name shows only the unmatched case, and a script with no organizations shows none), the largest certificate holders first. "After normalization" is what the join compares; for an unmatched name, the last column is the nearest GLEIF name in its block (same first token, or first two characters for names without spaces), which shows how far the miss is.

script_matching.py · 2026-10-25 09:35 UTC

The residual

In the warehouse, Chinese and Japanese names tie to an LEI at 6.9% and Latin names at 24.2%. The ground truth is the only place to ask why. Here "matches" is broader than in the first chart: any certificate organization on the owner's site, in any script, that normalizes to the owner's legal name, one of its other registered names, or its Wikidata label. On that definition, where the entity is known to have an LEI its name matches more often in Chinese and Japanese than in Latin: 454 of 576 Chinese and Japanese owners (79%) have their site in the warehouse and 85% of those are matched, against 41% and 62% for the 21,776 Latin-named owners. That is consistent with the warehouse gap being the share of organizations that hold an LEI at all, not the matcher; it cannot separate registry coverage from company size, since the ground truth skews to large listed entities in every script.

script_matching.py · ground truth cut by the script of the GLEIF legal name · 2026-10-25 09:35 UTC

A second check points the same way, with a weaker unit: the domain, not the entity. 2,384 of the 52,738 domains that carry a Chinese or Japanese certificate name also carry a Latin one. Often that is the same company's English name, but the check does not verify it (the two names are not linked through an LEI, and a shared domain can carry unrelated organizations), so read the counts as co-occurrence on a domain: on 358 of those domains a name in each script matches an LEI, on 370 only a native-script name does, on 293 only a Latin name does, and on 1,363 neither. On this evidence the native script is not the weak side.

Why matching is hard

Normalization is not where the difficulty lives: lowercasing, punctuation and legal forms take 230,814 raw certificate strings down to 211,389, a 8.4% reduction. The difficulty is that a certificate names whoever requested it, and that registered names are shared. Of the 9,540 ground-truth sites in the warehouse, 2,750 carry no certificate name that equals or contains the owner's registered name: registered-name disagreements, not proof that another organization is behind the site (135 of them carry the owner's common name and 1 its acronym). Each of those pairs is assigned the first category below that fires, from most to least specific; conclusions about who is behind the domain belong to the categories, not to the total.

Each category, defined, with one case (chosen by LEI order so the selection is fixed run to run):

differs_decomposition.py · 2026-10-25 09:35 UTC

The three largest such certifiers, with the ground-truth sites they certify and the number of domains they certify across the whole warehouse (candidates by fan-out; note 2 tests such certifiers with DNS, this table does not):

differs_decomposition.py · 2026-10-25 09:35 UTC

Shared names

The other half of the difficulty is that a registered name is not an identity. In GLEIF, 89,546 normalized names are shared by two or more active entities. In the warehouse, 7,507 certificate organizations match a GLEIF name exactly that several active entities share and cannot be assigned to one LEI (a further 281 match a single entity that the country check contradicts and are set aside for that reason, not because the name is shared). Ambiguity is an outcome the page carries, not one it resolves by picking the first row.

gleif_join.py · 2026-10-25 09:31 UTC

Why GLEIF, and what did not work

GLEIF is the one registry that is free, published daily, global, and carries three things a name match needs: other registered names and transliterations, the ownership hierarchy, and the legal-form list in every jurisdiction's language. Matching the 230,814 certificate organizations against its 3,677,445 active names ties 56,017 (24.3%) to a registered name, 4,992 of them only through an other name, and 9,615 of them to a name several entities share (the country check below settles 2,108 of those and sets 281 single-entity matches aside, leaving 7,788 that cannot be assigned to one LEI). Fuzzy matching of the 164,174 distinct normalized names that stage 1 left unmatched (several certificate organizations can share one normalized name), blocked on the first token and scored with a token-order-insensitive ratio, ties 2,646 more organizations to an LEI at a score of 90 or above after the country check (260 more organizations are ambiguous at that score). The threshold was set on a probe: withhold the exact match for 400 ground-truth names and ask the fuzzy stage to recover the known LEI. The best candidate is right for 259 of 400 at threshold 80, 170 at 90 and 99 at 95; a lower threshold recovers more, but the probe cases below show the best candidate being the wrong LEI even at a score of 100, so 90 is kept and nothing below it is persisted.

Fuzzy matches kept at the operating threshold, sampled across the score range:

What the probe sees, right and wrong. The input is the raw certificate name with punctuation stripped and legal forms kept; the probe knows the true LEI from the ground truth:

gleif_join.py · 2026-10-25 09:31 UTC

Blocking on the first token was measured rather than assumed: on the same probe, comparing against every GLEIF name instead recovers 270 right answers at threshold 80 where blocking recovers 259, and 109 against 99 at 95: 11 and 10 more of the 400. The blocked pass over the warehouse takes 10 seconds on a CPU, so the all-pairs pass was not built.

What we tried that failed

Country consistency at join time

Stripping legal forms equates names across countries: a Japanese 株式会社 and a German GmbH with the same trading name normalize to the same string, and a Korean Co., Ltd. matches a Dutch B.V. (the first demoted case below). The normalizer cannot tell them apart, so the join asks the evidence it already has, all public and deterministic: the share of the organization's domains under one country-code TLD, the script of its name (kana points to Japan, Hangul to Korea), the GLEIF country of other organizations already resolved on the same domains, and the legal form the certificate name ends in, read against the countries whose registers write it (an ApS is Danish, an AB Swedish or Finnish, an a.s. Czech, Slovak, Danish or Norwegian; a form written in more than six countries, like S.A., says nothing, and neither do the English forms every register renders its own as, like Corporation). Which registers write a form is read from the names GLEIF itself holds, with GLEIF's legal-form code list filling in where the names show nothing: the code list is a register of what each jurisdiction may file and its abbreviation columns are empty for several large registers, so on the list alone a Czech a.s. looked Danish. A name matching LEIs in several countries resolves to the one whose country the evidence supports, the legal form deciding only when no other evidence names a country; a single-LEI match whose country the demoting evidence contradicts is set aside as ambiguous (evidence from other organizations on the same domains or from the legal form supports a candidate but never demotes one, and a single country-code domain does not either). Registration hubs (Bermuda, the Caymans, the Channel Islands and the like) are never contradicted: such a holding runs its business and its domains from somewhere else. Nor is a candidate contradicted by the country-code domains of a neighbouring country: a Belgian company's customer-facing sites sit under .nl and a Swedish one's under .no, so the domains keep the candidate without naming its country (the neighbour table is land borders inside the EU and EEA plus the Nordic, Benelux, DACH, British Isles, China with its special administrative regions, North American and Australia/New Zealand groupings).

Before the rule, 46,402 exact matches named one LEI and 9,615 named several (8,321 across several countries, 1,294 within one country, which no country signal can split). The rule resolved 2,108 of the 9,615 ambiguous names (21.9%): 737 by the country code of its domains, 612 by the legal form in its name, 421 by the country code of its domains and the legal form in its name, 207 by other organizations on the same domains, 49 by the country code of its domains and other organizations on the same domains, 42 by the legal form in its name and other organizations on the same domains, 28 by the country code of its domains and the legal form in its name and other organizations on the same domains, 5 by the script of its name, 4 by the legal form in its name and the script of its name, 2 by the country code of its domains and the legal form in its name and the script of its name, 1 by the legal form in its name and other organizations on the same domains and the script of its name. It demoted 281 of the 46,402 single-LEI matches (0.61%): 252 on domain evidence and 30 on script, a name possibly carrying both. 2,144 single-LEI matches were kept although no evidence names their country, 66 of them because the LEI sits in a registration hub and 29 because the only evidence against them is the country-code domains of a neighbouring country. Among fuzzy matches it resolved 7 and demoted 70. After the rule: 48,229 unique, 7,788 ambiguous.

What the rule rejects, checked against the ground truth

A rule checked only on what it resolves is unchecked, so its rejections and its picks are measured against the ground truth on every run. What can be measured is how many known-correct candidates the rule rejects (recall lost on the ground truth), not what share of its demotions are wrong: that would need labelled demotions, which do not exist. Of 6,706 exact-name candidates that are the owner's own LEI, the rule marks 14 (0.21%) unsupported, 5 of them as contradicted; 6 ground-truth pairs lose every exact match to it. Of 358 country picks where the owner's LEI was among the name's candidates, 333 (93.0%) picked it and 25 picked another LEI.

Cases

Resolved by country: the name matches LEIs in two countries and the organization's own evidence picks one.

Demoted: the only LEI with that name sits in a country the organization's evidence contradicts, so the match is set aside as ambiguous rather than kept. Whether each demotion is right cannot be read from the name: a company whose only certified domains sit under a foreign country code (the second row) may still be the entity the certificate names, and the ground-truth check above measures how many known-correct candidates the rule rejects, not how many of its demotions are wrong.

gleif_join.py · 2026-10-25 09:31 UTC

What this can and cannot say

• It can say which certificate names tie to exactly one legal entity (50,875 of 230,814), how that varies by script, and, for entities with a known website, how often the certificate carries the owner's registered name (59% of the 9,540 present; 71% counting containment) against a name that passes neither check.
• It cannot say anything about the 58% of ground-truth pairs whose site had no organization-validated certificate logged in the period, nor which LEI a shared name belongs to (7,507 exact-name and 190 fuzzy matches shared by several entities after the country check), nor whether the 281 exact and 70 fuzzy matches set aside because their only entity sits in a country the organization's own evidence contradicts were right to set aside, nor whether a demoted match was wrong beyond the ground-truth check above, which counts known-correct candidates the rule rejects and does not measure how many demotions are wrong.
• The ground truth is skewed to large, listed and financial entities and to countries where small firms register an LEI; the per-country and per-script rates are rates on that set, not on the economy.
• Open. The traditional-to-simplified fold would recover 8 names and is not applied; the German digraph second key is tracked, not built. Remaining normalizer gaps (equivalence classes such as "Co Ltd" vs "Corporation", other transliteration schemes, multi-script names) are tracked, not fixed. The warehouse-wide share of domains carrying only a vendor's certificate is the next number this note should carry; note 2 measures the vendors themselves.