You can prevent spoofing by using HTTP requests or similar, instead of ICMP echo. Similar to https://ipv4.games/ (but with a canvas and color selection)