As an alternative to having the widget "report back to home," you could write a simple robot that crawls the websites and verifies that the the websites are indeed hosting the widget.
To avoid fraud, you would build the robot with the following considerations:
- Hidden identity. Make sure the site isn't only serving widget to robots by disguising your robots identity.
- Random crawl sampling. Ensure that your crawling uses a random sampling for when you crawl the sites. This prevents a site from anticipating the crawl and serving it only during that time.
- Verify that the widget is visible. Don't only check for the existence of the widget, but that the widget itself is visible and not hidden.
- Manual overview. Have your robot generate screen captures so you can review manually whether the widget is appearing.
There are some inherit difficulties that you will be faced based on the "pay-per-view" nature of leasing (to what extent, I do not know because I don't know the specifics of your agreement). The biggest problem is not people placing the widget in non-authorized URLs, but rather abusing the system by automatically (fraudulently) crawling the site to boost view counts. That should be your primary concern, as it is where the majority of the fraud will stem from.
The problem is, it is difficult to verify the legitimacy of a view from an embedded widget. With only access to JavaScript, you have limited capabilities for differentiating between a robot, a user constantly hitting refresh, and a legitimate user. Without access to the server side, your best option to prevent fraud is through browser fingerprinting. This will assist you monitoring abuse of your widget via constant refresh, et al. It is not a catch-all because it is still vulnerable to no-js / torbutton users which can spoof identities, but it does provide a good first-level of protection to repeat view fraud.