Malwack is a systemless hosts-file module that maps listed advertising, tracking, and malicious domains to non-routable addresses, then refreshes its merged blocklist on a configurable schedule.
Local Domain Blocking
Blocking occurs through Android's hosts resolution path and does not require a local VPN service.
Systemless Hosts
A module overlay supplies /system/etc/hosts without writing the original system partition.
Scheduled Updates
BusyBox crond runs the updater after boot and at the interval stored in minutes.txt, with 1,440 minutes as the default and maximum.
Terminal Controls
The malwack command can restore a minimal or default list, add an optional adult-content list, and remove an exact domain entry.
Update Process
- After Android finishes booting, the service locates the BusyBox binary provided by Magisk, KernelSU, or APatch.
- It copies the updater to writable temporary storage, creates a root cron entry, and runs an immediate update.
- The updater downloads every active source in
urls.txt, removes blank and comment lines, sorts the records, and keeps unique entries. - The merged result replaces the module's hosts overlay and is assigned root ownership with mode
0644. - The script sets
net.dns1andnet.dns2to Google's public DNS addresses, updates the module description, and records activity in/data/adb/malwack.log.
Installation and Controls
- Install the module ZIP from the Modules screen in the supported root manager.
- Reboot and confirm that
/data/adb/malwack.logreports a successful list update and cron startup. - Reboot again after a hosts update if applications continue using cached resolution results.
- Run
su -c malwack --helpin a terminal to review the supported restore and whitelist options.
malwack --restore-originalmalwack --restore-defaultmalwack --whitelist example.comCoverage and Limits
Hosts blocking affects only exact hostnames resolved through the operating system's normal resolver. It cannot reliably stop first-party advertisements, direct IP connections, applications with embedded resolution, or traffic sent through independent DNS-over-HTTPS. Large third-party lists can also block login, telemetry, payment, or content-delivery domains that an application needs.