If they copy the Javascript too, you could a code that checks if the domain matches and if not show a blank page (or something like that)