Cybersquatters Turn Chichester Baptist Church Site into Hidden Online Casino for Three Years

Church officials at Chichester Baptist Church in the UK stumbled upon a shocking reality in early March 2026, when they realized their official website had been cloned and repurposed into a covert online casino; operators had run gambling operations there undetected for three full years, luring players with slots, poker, and roulette under the guise of a legitimate religious site. The church, a community staple since its founding in the 19th century, remained completely unaware during that time, as cybersquatters mirrored the domain's content while overlaying casino features in the background, a tactic that kept visitors from suspecting foul play at first glance.

What's interesting here is how seamlessly the fake site blended religious imagery with gambling prompts; pages about sermons and events doubled as entry points to betting interfaces, and donation links redirected to deposit options for casino credits. Observers note that such cloning exploits trust in established domains, especially those tied to nonprofits like churches, which rarely check backend changes aggressively.

And then, in a twist that brought everything to light, a concerned member tipped off church leaders after spotting casino ads during what should have been a routine visit to the site for service times; that simple alert sparked an investigation revealing bets placed by thousands of users over the years, with transaction logs buried deep in the site's code.

Cybersquatters, likely based overseas given the operation's sophistication, first registered a near-identical domain variation around 2023, then mirrored Chichester Baptist Church's entire site structure using automated scraping tools; they injected casino software via iframes and pop-ups that activated only after specific user interactions, such as clicking on what appeared to be prayer request forms. Data from similar cases shows these groups often use bulletproof hosting in jurisdictions with lax enforcement, routing traffic through VPNs to mask their locations while processing payments via anonymous crypto wallets.

Turns out the church's original domain had lapsed in renewal due to administrative oversight during a leadership transition, allowing squatters to swoop in and redirect traffic; once in control, they maintained the facade by copying fresh content from the real church's social media, ensuring the clone stayed current and convincing. Experts who've studied domain disputes point out that religious organizations face heightened risks because they prioritize ministry over tech security, often skipping WHOIS privacy or two-factor authentication on registrar accounts.

But here's the thing: the casino raked in substantial revenue, with server logs indicating peak activity during evenings and weekends when churchgoers might logically visit; players deposited funds thinking they backed a licensed UK operator, only to find withdrawal issues later, classic hallmarks of rogue gambling dens.

Since the March 2026 discovery, Chichester Baptist Church leaders launched a multi-front fight, first notifying their domain registrar and filing a Uniform Domain-Name Dispute-Resolution Policy (UDRP) complaint through ICANN's established process, which handles cybersquatting globally; panels review evidence of bad faith registration and lack of legitimate interest, often siding with original owners in cases like this where trademarks or prior use prove clear. The church also looped in local police and cybersecurity firms to trace the operators, uncovering servers in Eastern Europe that hosted the casino backend.

Now, as of late March 2026, the fake site remains partially operational despite takedown requests, with squatters shifting domains slightly to evade blocks; church staff have issued public warnings via social media, urging members to use verified links, while pursuing civil claims for damages tied to reputational harm. Those who've followed the case closely observe that recovery efforts involve not just domain seizure but also content scrubbing to erase gambling metadata from search engines, a process that can drag on for months.

So the church ramped up security measures too, migrating to a new domain with enhanced protections like DNSSEC and regular audits; volunteers now monitor traffic patterns, spotting anomalies that could signal future clones early.

This incident underscores how illegal online gambling outfits prey on trusted domains, cloning them to bypass advertising bans and geo-restrictions; reports from the Europol's organised crime assessments highlight a surge in such masquerades across Europe, where operators disguise casinos as charities, news sites, or even government portals to attract unwitting users. Figures reveal that over 20% of flagged rogue sites in 2025 mimicked legitimate entities, processing billions in bets before detection.

Take one parallel case researchers documented, where a US nonprofit's domain hosted poker rooms for 18 months; patterns match Chichester's exactly, with cloned frontends hiding high-stakes tables and live dealer streams. And while the Baptist Church focused on community outreach, squatters exploited that openness, embedding affiliate links that paid out per signup, turning faith-based traffic into gambling leads seamlessly.

It's noteworthy that detection lagged because search engines indexed the clone higher initially, thanks to keyword stuffing from casino terms blended into Bible verses; SEO experts note this tactic boosts visibility in queries like "community events Chichester," funneling innocent searchers into bets. Yet churches aren't alone; schools and hospitals report similar hijacks, prompting calls for registrar-level alerts on suspicious transfers.

What's significant is the three-year runway these operators enjoyed, during which they likely evaded taxes and player protections entirely; transaction volumes suggest six-figure earnings monthly, funneled through unregulated payment processors that ignored AML checks.

Church administrators, undeterred, partnered with digital rights groups for pro bono support in the domain fight; progress reports from mid-March 2026 show partial IP blocks in the UK, though international users still access mirrors via proxies. Observers who've tracked cybersquatting trends emphasize proactive WHOIS monitoring as key, since lapses like Chichester's occur in about 15% of nonprofit domains annually, per industry audits.

But the rubber meets the road in enforcement: while UDRP rulings favor claimants 85% of the time, rogue operators often abandon domains and respawn elsewhere, necessitating constant vigilance. People in the church community have rallied too, sharing verified URLs and reporting fake sites to hosting providers, which has accelerated some shutdowns.

And as the story unfolds into April 2026, legal experts anticipate a court win for the church, potentially setting precedents for faster religious domain protections; until then, the episode serves as a stark reminder of digital vulnerabilities lurking just a click away.

The Chichester Baptist Church saga, from quiet hijack in 2023 to public showdown in March 2026, lays bare the cunning of cybersquatters who transform sacred digital spaces into gambling dens; while the church pushes forward with reclamation and safeguards, the case spotlights enduring gaps in domain security that demand collective action from registrars, search engines, and users alike. Data indicates such threats persist globally, but swift responses like this one offer blueprints for others facing the same shadowy tactics, ensuring trusted sites stay true to their missions.