Manually Edit Your Hosts File to Block Spam Redirects

A fake human-verification page can be a redirector rather than a genuine security check. It may appear when a mistyped advertisement, compromised search result, unwanted extension or altered DNS setting sends your browser to a domain that then bounces you elsewhere. Learning how to manually edit your hosts file to avoid a spam redirect gives you a narrow, reversible way to stop that destination from loading on one device.

The method works best when you can identify the exact hostname causing the redirect. It does not replace browser security, malware removal or careful link handling, and it will not help if the problem sits in your router, an extension or the website that linked to the spam page. The steps below cover common Windows, macOS and Linux setups used by many Australian households and workplaces.

What the fake check changes

The visible “human” check may be a script, a parked domain or a redirect chain. Some pages use genuine anti-bot technology, while others imitate one and then send traffic to an advertiser, phishing page or fake news destination. The hostname in the address bar can change several times, so the first page you saw may not be the source of the unwanted content.

The hosts file is a plain-text local lookup table. It maps hostnames to IP addresses before an ordinary DNS query is made. Mapping a known unwanted hostname to 127.0.0.1 tells the operating system to send that address to the local machine instead of the server hosting it.

That control is useful but limited. A hosts entry cannot block a search result, a browser notification or a redirect generated by an extension. It also blocks the entire hostname, so blocking a shared domain can interfere with legitimate email, account access or security checks. Add only a hostname you have verified.

Identify the actual redirect source

First, copy the suspicious address from the message without clicking it. Compare it with the address shown after loading, and note any new domain in the browser’s address bar. Re-test the suspect site only in a separate browser profile with extensions disabled, and do not enter credentials, approve notifications, download anything or complete the “verification”. If no new domain appears, the redirect may be coming from a search result, a compromised browser or your network.

If the site impersonates an Australian bank, retailer, government service or well-known organisation, retain screenshots, message timestamps and payment details. The ACCC’s Scamwatch service accepts reports about consumer scams, while banks and agencies have their own fraud channels. A separate guide to reporting deceptive verification pages explains how to preserve useful evidence and report a fake check without revisiting the malicious page.

Locate the hosts file on your device

On Windows 10 or 11, open Notepad as an administrator, choose File > Open and enter C:\Windows\System32\drivers\etc\hosts. Editing the copy in a normal folder or a file called hosts.txt will not affect Windows. Save directly to the same path when finished, then confirm that the file has not acquired a .txt extension.

On macOS, open Terminal and run sudo nano /etc/hosts. On Linux, use sudo nano /etc/hosts or the text editor supplied with the distribution. Enter the administrator or root password, make the change and save with the editor’s save command. The path is case-sensitive on some Linux systems, so /etc/hosts must be exact.

Phones generally do not provide a supported manual hosts editor. iPhones use DNS settings or a filtering profile, while Android offers Private DNS and content-blocking apps. This matters in Australia because households commonly combine Windows laptops, iPhones and Android devices from Samsung and other brands; apply the block to the device that displays the redirect rather than assuming it applies to every device.

Add a precise local block

Back up the file before changing it. On macOS or Linux, copy /etc/hosts to /etc/hosts.backup; on Windows, save a copy beside the original or use Save As with a different name. A backup matters because updates, security software or a future repair can replace or reset the file.

Type the offending hostname on its own line, without http://, https://, a path or query string. For a safe illustrative domain, the line would be 127.0.0.1 deceptive-check.example. Replace it with the exact hostname observed in the address bar. You can add a short comment with #, but the mapping itself must remain on one line. Save the file with administrator rights and close the editor.

Do not add a wildcard, the naked domain or several unverified aliases in one pass. A single precise entry makes troubleshooting easier. If the first blocked hostname leads to another unwanted hostname, confirm that second destination separately before adding it. Malware that continually rewrites hosts needs removal; repeated manual edits will only be temporary in that situation.

Flush caches and confirm the block

Close the browser after saving, then clear the affected site’s cached data. You can also flush the operating system’s DNS cache. Run ipconfig /flushdns in Command Prompt on Windows. On current macOS, use sudo dscacheutil -flushcache followed by sudo killall -HUP mDNSResponder; on Linux, sudo resolvectl flush-caches is commonly available, although the command varies by distribution.

Reopen the browser and try the original message link in a private window without entering information. The blocked hostname should fail to connect or load locally rather than display the fake check. Also test a familiar site to confirm that ordinary browsing still works. If the destination resembles a news or advertising site, a structured unknown-domain risk assessment can help decide whether the domain is merely unfamiliar or actively deceptive.

If the redirect persists only on one device, check extensions, browser notifications and recently installed programs. If it appears on several devices, inspect the home router, secure DNS settings and the network provider. Australian homes commonly access the NBN through providers such as Telstra, Optus or Vodafone, while mobile hotspots create another temporary network. Public Wi-Fi in cafés around Sydney, Melbourne and Brisbane often uses a sign-in portal; a redirect on one such network may belong to that network rather than your computer.

Recommended response checklist

Use a short checklist so the temporary block does not become an unexplained network change:

• Record the full URL and the exact hostname that begins the unwanted redirect.
• Back up the hosts file before opening it with administrator privileges.
• Add one verified hostname mapped to 127.0.0.1, avoiding broad domain blocks.
• Flush the DNS cache, restart the browser and test both the link and a known site.
• Remove the entry once the redirect service is no longer reachable or the risk has passed.
• Review extensions, browser notifications and DNS settings if the redirect persists.
• Keep evidence of impersonation, payment requests or harvested personal information for reporting.

For Australian legal context, if the redirect promotes products through electronic messages, the Spam Act 2003 can apply, setting consent, sender-identification and unsubscribe obligations for messages covered by that law. If an Australian-covered organisation mishandles personal information, the Privacy Act 1988 and Australian Privacy Principles may also apply. Domain appearance provides only a small clue: auDA regulates .com.au and direct .au registrations, but a familiar Australian suffix does not prove a site is safe.

The practical takeaway is to treat the hosts file as a precise containment tool: block only the confirmed hostname, retest the affected device and network, and remove the entry when it is obsolete. Persistent redirects call for checking the router, browser extensions and malware rather than adding ever-larger blocks.