Nginx serves site even if server_name does not match
nginx always has a default server. In the absence of any server block explicitly marked as default_server, nginx will use the first server with a matching listen directive.
You can define a catch-all server block to handle any host names that do not match your server_name value.
For example:
server {
listen 80 default_server;
listen 443 ssl default_server;
return 444;
}
Of course, browsers connecting over https will always complain about the certificate before nginx can process the request.
See this document for more.