I am not sure what it considered so difficult about checking an http requests origin against a list of blocked instances and just not responding if it is on the list.
Checking the origin of a request and modifying the response based on the origin is something servers do all the time.
So why are people calling it impossible/magic?