An update for people who happen to come across this topic: We deployed a global javascript-based sitelock that’s automatically applied to all HTML5 games.
If your game is loaded on an invalid domain, it replaces the game with a banner that encourages to viewer to go directly to your itch.io page. It should help capture traffic from the sites that have been trying to steal itch.io CDN urls up until now. Thanks!
If you have an issue or any questions about it, please post here: https://itch.io/t/614172/sitelock-update