Vacation Rental Fraud Report

Original weekly data from Bikoosh's monitoring of public Certificate Transparency logs: how many newly-certified domains match the naming patterns used in vacation-rental fraud. Aggregates only - patterns, not accusations.

stable citation URL: bikoosh.com/fraud-report/latest · this week's permanent record: /fraud-report/2026-09-21 · RSS · JSON feed

Which patterns fired

Top-level domains of suspicious matches

Trend

Weekly archive - the time series

Every week is a permanent, citable page; together they form a week-over-week series on rental-fraud domain patterns.

• Week of 2026-09-21 1391 suspicious · 14,356,555 certs
• Week of 2026-09-14 6547 suspicious · 71,255,574 certs
• Week of 2026-09-07 5917 suspicious · 73,537,142 certs
• Week of 2026-08-31 4451 suspicious · 81,530,767 certs
• Week of 2026-08-24 5299 suspicious · 79,185,184 certs
• Week of 2026-08-17 7625 suspicious · 64,942,253 certs
• Week of 2026-08-10 3691 suspicious · 54,504,000 certs
• Week of 2026-08-03 280 suspicious · 3,095,475 certs

Methodology

Bikoosh subscribes to the public Certificate Transparency stream - the log of all newly-issued HTTPS certificates. Each new domain name is tested against deterministic naming rules associated with rental fraud: rental vocabulary combined with destination city names, brand-lookalike patterns (typosquats, hyphen injection), and rental vocabulary on TLDs with high historical abuse rates. Matching is on names only at this stage; a name match is a statistical signal, not a verdict about any specific domain - which is why this report publishes only aggregates and never names domains.

Numbers regenerate weekly from live pipeline data. Weeks run Monday-Sunday, UTC.

Subscribe to the weekly report

Pull it into any reader - RSS or JSON feed - or get it by email (one message per weekly publish, double opt-in, unsubscribe in every send):

Cite this report

@misc{bikoosh_fraud_2026_09_21,
  title        = {Vacation Rental Fraud Report, week of 2026-09-21},
  author       = {{Bikoosh}},
  year         = {2026},
  howpublished = {\url{https://bikoosh.com/fraud-report/2026-09-21}},
  note         = {Weekly aggregate counts of newly-certified domains matching
                  vacation-rental fraud naming patterns, from public Certificate
                  Transparency logs. Licensed CC BY 4.0.}
}

Questions or data requests: [email protected]