multi-home High Sierra and block one address? I run Apache on my Macbook Pro for off-line use of a web app.  But for "self-defense" online, I use /etc/hosts to map certain hostnames to 127.0.0.1 which means if a webpage causes a GET to one of these, it hits my local webserver instead.  

I would rather they do nothing.  If I point them to an address that I know is unreachable, e.g., 10.250.250.250, then a poorly designed web page may not render until the GET times out.

In 10.13.4, how do I (Can I) point them to a separate private address that will be handled on the Macbook and set that address to immediately reject everything?  (Without changing how loopback behaves.)

(By the way, Apple documentation has long claimed that /etc/hosts is only used in single-user mode.  I have found that to be false on many versions of OS X/MacOS.)
The easiest way to achieve a guaranteed reject with no timeout is to use a broadcast address 255.255.255.255. Edit your /etc/hosts file and for hosts that you want request rejected put an entry such as:

255.255.255.255  rejectedhost.com
255.255.255.255  someotherhost.net


This free and simple technique can also be used to block out advertisement hosts on ad-ridden or popup-ridden web pages.