[matoro]

With nginx I also set the return code to 444 on the default virtual host, this is not a real status code but instead tells nginx to kill any connections to this vhost at the TCP level.

[usr1106]

I have used a default host with a self signed certificate and 444 for while. One advice was to make it support only the NULL cipher, but I did not succeed to do that, don't remember the details now.

However, many scanners still end with a full 400. Either their implemenations are so bad or they intentionally send corrupted requests to try to exploit some vulnerability. I have not digged any deeper.

[zhfliz]

for https, since 1.19.4 you can reject the tls handshake early https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_...