The Hosts File: A One-Line DNS Hijack Hiding in Plain Sight

Windows resolves host names through DNS, but before it ever asks a DNS server it consults one small local file: %SystemRoot%\System32\drivers\etc\hosts. Any mapping in that file wins, machine-wide, for every process. That makes the hosts file one of the highest-leverage, lowest-effort tampering targets on a Windows box — a single line changes where traffic goes, and nothing on the system flags it.

Two attacks, one file

Almost every malicious hosts-file edit falls into one of two buckets:

• Blackholing security and update domains. Malware points windowsupdate.microsoft.com, Defender definition endpoints, or third-party AV domains at 0.0.0.0 or 127.0.0.1. The machine can no longer patch or pull new signatures, so it stays quietly vulnerable and undefended — often the very first thing a dropper does.
• Hijacking traffic to a public IP. A phishing kit maps a bank, SSO, or vendor domain to an attacker-controlled server. The URL in the address bar looks correct; the packets go somewhere else. This is a cheap man-in-the-middle that needs no certificate on the wire until TLS is presented.

Both changes are a single file write, survive reboots, and are invisible unless something actually reads and reasons about the file.

What the audit checks

WinSentinel''s new Hosts File Integrity module runs as part of a normal single-machine --audit. It reads the local hosts file, parses every mapping, and applies four checks:

• Blackholed security/update domains (Critical). Any Windows Update, Defender, or known-AV domain redirected to a non-routable address (0.0.0.0, loopback, IPv6 unspecified). This is the classic "keep the box unpatched" tactic and is treated as a hard finding.
• Public-IP redirects (Warning). Any host name mapped to a routable public IP — the traffic-hijack signal. Private ranges (RFC1918), CGNAT, link-local, and loopback are correctly excluded so a normal internal override doesn''t cry wolf.
• Unusually large hosts files (Info). Thousand-plus-entry files are usually benign ad/tracker blocklists, but the size is exactly where a malicious line hides. The audit surfaces the count so you can confirm the source is trusted.
• Unreadable file (Info). If the file exists but can''t be read, the audit says so honestly instead of returning a false pass — re-run elevated.

What a finding looks like

[CRITICAL] Security/update domains are blackholed in the hosts file
  2 security-relevant domain(s) are redirected to a non-routable
  address (update.microsoft.com, wdcp.microsoft.com). This silently
  blocks Windows Update and/or AV definition updates.
  Fix: notepad %SystemRoot%\System32\drivers\etc\hosts

A clean machine — the normal 127.0.0.1 localhost / ::1 localhost pair — passes all four checks with no noise.

Why it''s free

This is a local, single-machine check: it reasons only about the contents of one file on the box it runs on. Like every audit module in the open-source core, it ships free. Fleet-wide rollups — "which of my 80 machines have a tampered hosts file?" — are the Pro control-plane story, but the detection itself belongs to everyone.

Try it

dotnet tool install --global WinSentinel.Cli
winsentinel --audit

The Hosts File Integrity module runs automatically as part of the full audit. If your box is clean you''ll see four passes; if something has been tampering with your DNS at the file level, you''ll know in seconds.