Blocking IP Addresses
From the Block/Allow IPs page of your Expedited WAF dashboard, add each IP or CIDR-notated IP range that you want to block:
All requests from that IP/range will be stopped at the WAF and will not reach your Heroku application.