Original data · week of 2026-10-05 · current
27 suspicious rental domains this week
In the week of 2026-10-05, 27 newly-certified domains matched vacation-rental fraud naming patterns, out of 637,719 certificates observed in public Certificate Transparency logs - one in every 23,619.
Weeks run Monday-Sunday, UTC. This page is the permanent record for the week of 2026-10-05 and is also served at the stable address bikoosh.com/fraud-report/latest. Aggregates only - patterns, not accusations; no domain is ever named.
Which patterns fired
| Pattern | Domains |
|---|---|
| vocab+tld | 27 |
Top-level domains of suspicious matches
| TLD | Domains |
|---|---|
| .shop | 20 |
| .site | 5 |
| .online | 1 |
| .xyz | 1 |
Rental vocabulary in matched names
| Keyword | Domains |
|---|---|
| rental | 16 |
| villa | 6 |
| stay | 2 |
| booking | 1 |
| vacation | 1 |
| bnb | 1 |
Methodology
Bikoosh monitors the public Certificate Transparency stream - the append-only log of all newly-issued HTTPS certificates. Each new domain name is tested against deterministic naming rules associated with rental fraud: rental vocabulary combined with destination city names, brand-lookalike patterns (typosquats, hyphen injection), and rental vocabulary on TLDs with high historical abuse rates. Matching is on names only; a name match is a statistical signal, not a verdict about any specific domain - which is why this report publishes only aggregates.
Cite this week
Bikoosh Vacation Rental Fraud Report, week of 2026-10-05. bikoosh.com/fraud-report/2026-10-05. Licensed CC BY 4.0 - reuse with attribution.
BibTeX
@misc{bikoosh_fraud_2026_10_05,
title = {Vacation Rental Fraud Report, week of 2026-10-05},
author = {{Bikoosh}},
year = {2026},
howpublished = {\url{https://bikoosh.com/fraud-report/2026-10-05}},
note = {Weekly aggregate counts of newly-certified domains matching
vacation-rental fraud naming patterns, from public Certificate
Transparency logs. Licensed CC BY 4.0.}
}
Booking a rental this week? Run the listing through the free checker first. Manage properties? Bikoosh watches your portfolio for clones behind numbers like these.
Questions or data requests: [email protected] · subscribe: RSS · JSON feed · email digest