Traffic that goes to the IP directly, even if there are domain names registered, are usually scanners and bots, and maybe, every now and again, a developer. Search engines don't access IPs directly, except when you have no domain names configured.

This is a quite legitimate catch-all setup for nginx that defines a response to any access that is not defined through a virtual-server-conf (it just returns HTTP Status 400):

server {

    listen 80 default_server;
    
    access_log off;
    error_log off;

    # basically just return an error
    return 400;

}

From a security point of view, is it safe to redirect an http request for direct IP address to the domain name?

yes, usually it is no problem. if you are in super-paranoid mode you might follow the approach below.

Traffic that goes to the IP directly, even if there are domain names registered, are usually scanners and bots, and maybe, every now and again, a developer. Search engines don't access IPs directly, except when you have no domain names configured.

This is a quite legitimate catch-all setup for nginx that defines a response to any access that is not defined through a virtual-server-conf (it just returns HTTP Status 400):

server {

    listen 80 default_server;
    
    access_log off;
    error_log off;

    # basically just return an error
    return 400;

}

traffic that goes to the ip directly, even if there are domain-names registered, are usually scanners and bots, and maybe, every then and there a developer. searchengines dont access ips directly, except when you have no domain-names configured. this is a quite legit catch-all setup for nginx that defines a response to any access that is not defined throughj a virtual-server-conf (it just returns HTTP Status 400)

server {

    listen 80 default_server;
    
    access_log off;
    error_log off;

    # basically just return an error
    return 400;

}

Traffic that goes to the IP directly, even if there are domain names registered, are usually scanners and bots, and maybe, every now and again, a developer. Search engines don't access IPs directly, except when you have no domain names configured.

This is a quite legitimate catch-all setup for nginx that defines a response to any access that is not defined through a virtual-server-conf (it just returns HTTP Status 400):

server {

    listen 80 default_server;
    
    access_log off;
    error_log off;

    # basically just return an error
    return 400;

}