A hardened, fully-offline hosts-file sinkhole for Windows and Linux — null-route known tracker / telemetry / ad domains to
0.0.0.0system-wide, so a lookup dies on your own machine before any request leaves it. No server, no browser extension, no background daemon. Block the trackers. Read the list. Revert in one click.
Strix Sinkhole is part of the open-source Strix Advanced Tools suite of privacy & security utilities for Windows and Linux.
A "sinkhole" is the simplest possible ad/tracker block: point a known bad domain
at a dead address (0.0.0.0) in the system hosts file, and every program on the
machine — browsers, apps, the OS — gets nothing back when it tries to reach it. No
request ever leaves your computer.
Unlike Pi-hole, Strix Sinkhole runs no server. Unlike a browser extension, it
protects every app, not just one browser. It has no background daemon and makes
no network calls of its own — except an explicitly opt-in list updater you
have to ask for. The hosts file is a classic malware target, so the whole point
of this tool is to edit it safely: everything it writes is namespaced, backed
up, reversible, and refuses to break your machine.
- System-wide blocking — null-routes tracker / telemetry / ad domains to
0.0.0.0(and::with--ipv6) in the realhostsfile. Works for the whole OS, offline, with no proxy or DNS server in the middle. - Namespaced managed block — everything Strix writes lives between
BEGIN/ENDmarkers. Your ownhostsentries and the system defaults (localhost,::1, …) are copied byte-for-byte and never touched. Every write runs anassert_preserves_usercheck first and refuses if your section would change. - Never breaks the machine — a built-in guard refuses to blackhole critical
infrastructure (OS/security update, certificate revocation / OCSP, time sync,
localhost) no matter what any blocklist says. - Reversible — a timestamped backup is written before every change, with one-click restore, and disable removes the block and restores the exact original file.
- No injection — only syntactically valid single hostnames are ever written,
each as
0.0.0.0 <domain>; arbitrary IPs or extra tokens in an imported list are dropped, never copied into yourhostsfile. - Dry-run first —
preview(CLI) / Preview changes (GUI) shows exactly what would be added and removed before anything is written. - Curated seed list — ships with a small, auditable seed blocklist
(
blocklists/strix-seed.txt, ~177 well-known domains). Import your own lists or opt in to fetch a larger one over HTTPS. - Allowlist — mark any domain as never-blocked to clear a false positive.
| File | What it is |
|---|---|
strix_sinkhole_core.py |
Pure, unit-tested engine (parsing, filtering, hosts assembly, safety invariants). No side effects in the pure functions. |
StrixSinkhole.py |
Dark desktop GUI (tkinter, standard library only — no third-party deps). |
strixsink.py |
Linux CLI front-end. |
blocklists/strix-seed.txt |
Curated seed blocklist (~177 domains). |
tests/test_sinkhole.py |
Self-running test suite — python tests/test_sinkhole.py. |
Run from source (any OS): the only requirement is Python 3.9+ with tkinter
(bundled on Windows; python3-tk on Debian/Ubuntu). There are no third-party
dependencies.
git clone https://github.com/strix-tool/strix-sinkhole
cd strix-sinkhole
# GUI (Windows and Linux)
python StrixSinkhole.py
# CLI (Linux)
sudo python3 strixsink.py statusDownload the installer from the
Releases page when
available, or just run StrixSinkhole.py from source. Applying changes needs
Administrator rights — the GUI runs read-only otherwise and offers a Restart as
admin button (it relaunches via the absolute interpreter path, not PATH).
The build is not code-signed yet. Because editing the
hostsfile is a known malware technique, Windows SmartScreen or your AV may flag it on first run — choose More info → Run anyway. This is documented honestly in SECURITY.md.
Install the .deb from Releases
when available, or run from source. Writing /etc/hosts needs root, so the CLI
commands that change it are run with sudo.
sudo python3 strixsink.py status # show current state
sudo python3 strixsink.py preview # dry-run: diff of what would change
sudo python3 strixsink.py enable # back up + blackhole the lists
sudo python3 strixsink.py disable # remove the block, restore your section
sudo python3 strixsink.py restore # roll back to the latest backup
sudo python3 strixsink.py allow ads.io # never block this domain
sudo python3 strixsink.py update https://… # opt-in: fetch + merge a remote listUseful flags: --ipv6 (also null-route to ::), --list FILE (merge an extra
local blocklist, repeatable), --yes (non-interactive), --hosts PATH (operate on
a different file — handy for testing).
python StrixSinkhole.pyA dark, single-window app: Enable / Disable / Preview changes / Restore backup, an allowlist editor, an Import list file button, an opt-in Update from URL dialog, and a live activity log that shows the exact diff before you apply it.
The hosts file is a high-value target, and any blocklist you import is
untrusted input — so integrity matters. Strix Sinkhole edits only its own
namespaced block, verifies your section is unchanged before every write, writes
atomically with a timestamped backup, and hard-refuses to blackhole critical
infrastructure regardless of what a list says. It runs with least privilege
(admin/root only to write the file; read-only otherwise) and makes no network
calls except the opt-in HTTPS updater. Read the full threat model and hardening
list in SECURITY.md. Found a vulnerability? See its reporting
section.
Strix Sinkhole calls no third-party services and bundles no external code; the curated seed list draws on the community's shared knowledge of well-known tracker and telemetry endpoints. Thanks and references: ACKNOWLEDGEMENTS.md.
MIT © 2026 Strix Advanced Tools. Use only on machines you own or are authorized to administer.