Tell HN: Please update your DNS records when abandoning servers
While domain registrants should certainly be careful that their DNS records point to trusted servers only and should definitely remove any stale DNS entries, we should also configure our web-servers to return successful response for specific hostnames only and error/no response for everything else. Here is roughly how the configuration for, say, https://example.com/, would look like:  sudo mkdir /etc/nginx/ssl
  sudo openssl req -x509 -newkey rsa:4096 -nodes -keyout /etc/nginx/ssl/key.pem -out /etc/nginx/ssl/cert.pem -days 365 -subj "/CN=localhost"

  echo "server {
      listen 80 default_server;
      listen [::]:80 default_server;
      listen 443 ssl default_server;
      listen [::]:443 ssl default_server;
      ssl_certificate /etc/nginx/ssl/cert.pem;
      ssl_certificate_key /etc/nginx/ssl/key.pem;
      return 444;
  }" > /etc/nginx/sites-enabled/default

  echo "server {
      listen 443 ssl;
      listen [::]:443 ssl;
      server_name example.com;
      ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
      ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
      root /var/www/example.com;
  }
  server {
      listen 80;
      listen [::]:80;
      server_name example.com;
      return 301 https://example.com$request_uri;
  }" > /etc/nginx/sites-enabled/example.com

The self-signed certificate for the default_server is okay. The client will get a TLS certificate issue. That's fine because we don't anyone to be using the default_server anyway. If the client decides to proceed despite the TLS certificate issue, then the 'return 444' directive would close the connection without response.