Five categories, one switch
With Shield on, all five categories below work together. The lists update themselves every 24 hours; there are about 380 thousand rules in total.
Ads and trackers
Ad networks, analytics and tracking services, and the servers of tracking libraries built into apps.
AdGuard DNS filter + AdAway · ~185k rulesMalware
Known addresses that distribute malware or control infected devices.
URLhaus Malicious URL Blocklist + Dandelion Sprout Anti-MalwarePhishing
Fake pages that imitate a real site to steal your sign-in details.
PhishTank & OpenPhish list + Phishing ArmyScams
Known scam sites: addresses built to trick people out of money or information.
DurableNapkin scam blocklistCryptomining
Script servers of pages that use your browser to mine cryptocurrency without your knowledge.
NoCoin
How does it work?
Shield is not an app; it is the path your DNS lookups take. Before your device connects to a site it asks for the site's address; Shield answers that question inside the encrypted tunnel, on our own resolvers.
- Your deviceAsks for a name's address
- Encrypted tunnelInside Colitu VPN, DNS-over-HTTPS
- Colitu resolverAdGuard Home · Sweden, United Kingdom, Poland
- Filters5 categories, ~380k rules
- AnswerClean name: real address · blocked name: 0.0.0.0
- For a blocked name the server answers 0.0.0.0: the app can never reach that server, the dangerous page does not open and the tracker cannot send data.
- Names that are not on the lists are asked to Cloudflare and Quad9 over DNS-over-HTTPS. EDNS Client Subnet is off; they see our server's address, not yours.
- The DNS-over-HTTPS service can only be reached from inside the tunnel. If one server does not answer, the app moves to the next.
Privacy: what we do not see
A protection layer is only protection if it does not watch you. On Shield's resolvers, these are switched off:
Query log off
Which names you ask for, and so which sites you open, is written down nowhere. We cannot see it either.
Statistics off
No per-user counters, no lists of most-asked or most-blocked names are kept on the server.
No new data collected
Switching Shield on creates no extra record for your account; nothing was added to our data inventory.
ECS off
No part of your network is passed on to the upstream resolvers.
What does it do, and what not?
It does
- Stops the names on the lists from resolving for every app on your device (in TUN mode and on mobile; in system proxy mode only apps that use the proxy are covered).
- Carries your DNS lookups encrypted inside the tunnel.
- Blocks ad, tracker, malware, phishing, scam and cryptomining addresses.
- Keeps no query log and no per-user statistics.
It does not
- Block ads that are served from the same domain as the content. YouTube video ads are an example.
- Replace antivirus software: it only stops known bad addresses and does not scan files on your device.
- Recognise new or unknown dangerous addresses that are not on the lists.
- Work if your browser's own “Secure DNS” setting is on; the browser then bypasses Shield. Turn that setting off or set it to automatic.
- Guarantee that no legitimate site is ever blocked. Occasionally one may be; then turn Shield off for a moment and tell support.
How to turn it on
- In the Colitu app open Settings → Connection on Windows and Linux, or Account → Features on Android and iOS.
- Turn on the Ad blocking switch; Shield is the protection behind it. The app reconnects for a moment.
- To turn it off, switch it off again.
Roadmap Not live yet
The items below are planned but are not in Shield today, and we give no dates. Today Shield is a single switch and the categories cannot be chosen one by one.
- Optional adult-content filterA separate category for family or work devices.
- Personal blocklist and allowlistBlock names of your own, or allow a site that was blocked by mistake.
- On-device counterA “N trackers blocked today” number computed on your device and never sent to us.
- Per-category togglesTurning each category on and off separately.
The ad blocking test shows in a few seconds whether well-known ad and tracker domains are blocked on your device.
Frequently asked questions
What is Colitu Shield?
An optional DNS filter you can switch on and off in the Colitu app. It stops ad, tracker, malware, phishing, scam and cryptomining addresses from resolving.
Which apps have it?
The Windows, Android, iOS and Linux apps. On Windows and Linux use TUN mode to cover the whole device; in system proxy mode only apps that use the proxy are protected.
Can you see which sites I open?
No. Query logging and statistics are switched off completely on Shield's resolvers. Which names you ask for is stored nowhere and we keep no per-user counters.
Does it replace antivirus?
No. Shield only stops connections to known bad addresses; it does not scan files on your device and cannot recognise dangers that are not on the lists. Keep using your antivirus.
A site I trust does not open. What should I do?
Rarely, a legitimate site is blocked by mistake. Turn Shield off for a moment, use the site, then tell our support team about it and we will take care of getting it off the list.
Does it block YouTube ads?
No. YouTube video ads come from the same domain as the video and cannot be told apart at the DNS level. The same goes for ads inside Instagram or Twitch feeds.
Will it slow down my connection?
Usually not. Lookups already travel inside the tunnel, frequent names come from the cache, and blocked ads are never downloaded.
Try Shield yourself
Download the Colitu app, connect and turn on the ad blocking switch. You can turn it off whenever you like.