To answer your question - nginx picks the first server if there's no match. See documentation:
If its value does not match any server name, or the request does not contain this header field at all, then nginx will route the request to the default server for this port. In the configuration above, the default server is the first one...
Now, if you wanted to have a default catch-all server that, say, responds with 404 to all requests, then here's how to do it:
server {
listen 80 default_server;
listen 443 ssl default_server;
server_name _;
ssl_certificate <path to cert>
ssl_certificate_key <path to key>
return 404;
}
Note that you need to specify certificate/key (that can be self-signed), otherwise all SSL connections will fail as nginx will try to accept connection using this default_server and won't find cert/key.