Original data · week of 2026-11-02 · current
32 suspicious rental domains this week
In the week of 2026-11-02, 32 newly-certified domains matched vacation-rental fraud naming patterns, out of 965,990 certificates observed in public Certificate Transparency logs - one in every 30,187.
Weeks run Monday-Sunday, UTC. This page is the permanent record for the week of 2026-11-02 and is also served at the stable address bikoosh.com/fraud-report/latest. Aggregates only - patterns, not accusations; no domain is ever named.
Which patterns fired
| Pattern | Domains |
|---|---|
| vocab+tld | 32 |
Top-level domains of suspicious matches
| TLD | Domains |
|---|---|
| .shop | 30 |
| .online | 1 |
| .xyz | 1 |
Rental vocabulary in matched names
| Keyword | Domains |
|---|---|
| rental | 28 |
| stay | 1 |
| villa | 1 |
| holiday | 1 |
| booking | 1 |
Methodology
Bikoosh monitors the public Certificate Transparency stream - the append-only log of all newly-issued HTTPS certificates. Each new domain name is tested against deterministic naming rules associated with rental fraud: rental vocabulary combined with destination city names, brand-lookalike patterns (typosquats, hyphen injection), and rental vocabulary on TLDs with high historical abuse rates. Matching is on names only; a name match is a statistical signal, not a verdict about any specific domain - which is why this report publishes only aggregates.
Cite this week
Bikoosh Vacation Rental Fraud Report, week of 2026-11-02. bikoosh.com/fraud-report/2026-11-02. Licensed CC BY 4.0 - reuse with attribution.
BibTeX
@misc{bikoosh_fraud_2026_11_02,
title = {Vacation Rental Fraud Report, week of 2026-11-02},
author = {{Bikoosh}},
year = {2026},
howpublished = {\url{https://bikoosh.com/fraud-report/2026-11-02}},
note = {Weekly aggregate counts of newly-certified domains matching
vacation-rental fraud naming patterns, from public Certificate
Transparency logs. Licensed CC BY 4.0.}
}
Booking a rental this week? Run the listing through the free checker first. Manage properties? Bikoosh watches your portfolio for clones behind numbers like these.
Questions or data requests: [email protected] · subscribe: RSS · JSON feed · email digest