htaccess - Deny requests from unauthorized domains

Question

I have a website "www.mysite.com", and it has an its own ip. Now since few months I see several domains pointing to my ip server (it's not a shared ip). I can navigate thru the entire website with those unauthorized domains, they get indexed in google with my contents and all.

How can i set my htaccess to allow requests only for "www.mysite.com" ?

UPDATE

this is the .htaccess I've written so far with the suggestions, but somehow the first page is still served, with no images tho

.htaccess

SetEnvIfNoCase Referer "^http://(www.)?thiefdomain.com" spam_ref  
SetEnvIfNoCase Referer "^http://(www.)?thiefdomain2.com" spam_ref2


<FilesMatch "(.*)">  
    Order Allow,Deny  
    Allow from all  
    Deny from env=spam_ref  
    Deny from env=spam_ref2  
</FilesMatch>  

RewriteEngine On  
RewriteCond %{REQUEST_FILENAME} -s [OR]  
RewriteCond %{REQUEST_FILENAME} -l [OR]  
RewriteCond %{REQUEST_FILENAME} -d  
RewriteRule ^.*$ - [NC,L]  
RewriteRule ^.*$ index.php [NC,L]  

How can I avoid the first page to be displayed?

Answer 1

If you want to do with mod_rewrite, you can check SERVER_NAME to block unauthorized domains:

RewriteEngine on
RewriteCond %{SERVER_NAME} ^(www\.)?thiefdomain1\.example$ [OR]
RewriteCond %{SERVER_NAME} ^(www\.)?thiefdomain2\.example$ [OR]
RewriteCond %{SERVER_NAME} ^(www\.)?thiefdomain3\.example$
RewriteRule ^ - [F]

or

RewriteEngine on
RewriteCond %{SERVER_NAME} !^(www\.)?yourdomain\.example$
RewriteCond %{SERVER_NAME} !^(www\.)?yourdomain-alias\.example$
RewriteRule ^ - [F]

---

If you have root privileges, you can also solve the problem with name-based virtual hosting as follows:

NameVirtualHost *:80

<VirtualHost 192.0.2.100:80>
  ServerName dummy
  <Location />
    Order deny,allow
    Deny from all
  </Location>
  ...
</VirtualHost>

<VirtualHost 192.0.2.100:80>
  ServerName www.yourdomain.example
  ServerAlias yourdomain.example
  ...
</VirtualHost>

The first VirtualHost definition is treated as a default virtual host. If 192.0.2.100 is accessed as thiefdomain1.example, thiefdomain2.example, thiefdomain3.example, or any other hostnames except for www.yourdomain.example or yourdomain.example (defined in the second VirtualHost), Apache refers the first VirtualHost and returns 403 Forbidden status.