Put CORS in place and a strict CSP. Look the Host header in your API backend and block it. It might be forged, but probably not. Identify their host (reverse

Put CORS in place and a strict CSP. Look the Host header in your API backend and block it. It might be forged, but probably not. Identify their host (reverse IP lookup) and block requests from that ASN. If they host in same place as you, complain and get them shut down (or move). The obfuscated JS based domain checking others suggested. None of these is perfect, but they don’t have to be. Just keep adding layers until they go away for good.