In Next.js you can use middleware to sniff the domain and do something (block or redirect to your own): https://nextjs.org/docs/app/building-your-application/routin...

On the frontend you can also use Javascript to do the same thing and just redirect their traffic to your own (or block them).

Make sure to specify canonical tags etc too so Google doesn't think those duped domains are yours.

If you have any API routes, make sure you set up CORS and CSPs and such to block requests from unauthorized domains.

(Edit: You can probably also just throw Cloudflare in front of the whole setup: https://vercel.com/docs/integrations/external-platforms/clou...)