Could you not do a domain check of some kind in the JS payload and just document.write the entire thing with a bigass notice if it's not on your blessed domain?

You'd have to move the domain check in syntax and placement I guess, in an annoying game of cat and mouse... but it'd be something I suppose? Probably not worth it if it's not a large enough return.