Original data · week of 2026-10-26 · current
16 suspicious rental domains this week
In the week of 2026-10-26, 16 newly-certified domains matched vacation-rental fraud naming patterns, out of 990,818 certificates observed in public Certificate Transparency logs - one in every 61,926.
Weeks run Monday-Sunday, UTC. This page is the permanent record for the week of 2026-10-26 and is also served at the stable address bikoosh.com/fraud-report/latest. Aggregates only - patterns, not accusations; no domain is ever named.
Which patterns fired
| Pattern | Domains |
|---|---|
| vocab+tld | 16 |
Top-level domains of suspicious matches
| TLD | Domains |
|---|---|
| .xyz | 5 |
| .online | 4 |
| .club | 2 |
| .site | 2 |
| .shop | 2 |
| .rest | 1 |
Rental vocabulary in matched names
| Keyword | Domains |
|---|---|
| stay | 7 |
| booking | 3 |
| villa | 3 |
| holiday | 1 |
| bnb | 1 |
| rental | 1 |
Methodology
Bikoosh monitors the public Certificate Transparency stream - the append-only log of all newly-issued HTTPS certificates. Each new domain name is tested against deterministic naming rules associated with rental fraud: rental vocabulary combined with destination city names, brand-lookalike patterns (typosquats, hyphen injection), and rental vocabulary on TLDs with high historical abuse rates. Matching is on names only; a name match is a statistical signal, not a verdict about any specific domain - which is why this report publishes only aggregates.
Cite this week
Bikoosh Vacation Rental Fraud Report, week of 2026-10-26. bikoosh.com/fraud-report/2026-10-26. Licensed CC BY 4.0 - reuse with attribution.
BibTeX
@misc{bikoosh_fraud_2026_10_26,
title = {Vacation Rental Fraud Report, week of 2026-10-26},
author = {{Bikoosh}},
year = {2026},
howpublished = {\url{https://bikoosh.com/fraud-report/2026-10-26}},
note = {Weekly aggregate counts of newly-certified domains matching
vacation-rental fraud naming patterns, from public Certificate
Transparency logs. Licensed CC BY 4.0.}
}
Booking a rental this week? Run the listing through the free checker first. Manage properties? Bikoosh watches your portfolio for clones behind numbers like these.
Questions or data requests: [email protected] · subscribe: RSS · JSON feed · email digest