This is an evil way to deal with hotlinking as well.

I was thinking sending it to a rickroll would be a nice way to deal with it.

less likely to cause a legal issue than some of the other suggestions, imo.

In nginx you can set a default server block for an ip:port which just drops the connection (or does whatever):

# Close connection for any host not defined
server {
  listen 67.67.67.67:80 default;
  return 444;
}

and then define server blocks for specific hosts:

server {
  listen 67.67.67.67:80;
  server_name example1.com www.site2.com;
  ...
}

[/code]