Use a simple block rule, not a WAF rule, those are free.