To improve security, prevent host header attacks, and preserve your search rankings, here is what I recommend:
No default site
Simply drop all traffic not matching your genuine website. Before using the below config, execute the following example command on your server to generate self-signed "dummy" certificates which are necessary for responding to HTTPS requests.
mkdir /etc/ssl/dummy && openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/ssl/dummy/dummy.key -out /etc/ssl/dummy/dummy.crt
Now use the following two server blocks for your default site configuration.
listen [::]:80 default_server;
listen 80 default_server;
listen [::]:443 ssl http2 default_server;
listen 443 ssl http2 default_server;
Reload Nginx and it will drop all the copycat site connections.
Somewhere in your genuine site's server block, add the following header to prevent someone embedding your site as a frame / iframe at their domain name.
add_header X-Frame-Options "SAMEORIGIN";
<head> section of every page, add a canonical URL link element. If every page has something like
<link rel="canonical" href="https://www.your-site.com/your-page/"> then even if someone copies your site at their domain name, search engines recognise your site as the original.