I assume that you are trying to reject malicious requests. Something like this might work (unverified).
Configure the server by default (it catches any requests that do not match the name of the existing server), and then redirects the client back to itself:
server { listen 80 default_server; rewrite ^ http://127.0.0.1/; }
You will need to configure a similar catch-all for invalid locations inside valid server blocks. There may be more headaches than you want.
I do not know how realistic this would be in practice. It might be better to consider fail2ban or some other tool that can track your logs and ban clients on the firewall.
source share