Some progress...

I've worked out (with a little help from a website or two) how to whitelist and blacklist sites just with the hosts file (whitelist with actual IP / domain name; blacklist with 0.0.0.0 / top level domain). I've found a long list of top level domains which I've copied into hosts (SYS:Prefs/Env-Archive/sys/net/hosts/) - each point to 0.0.0.0 and the TLD as e.g. .COM

Here's a snippet:

0.0.0.0 .ac
0.0.0.0 .academy
0.0.0.0 .accenture
0.0.0.0 .accountant
0.0.0.0 .accountants

This all looks present and correct in Hosts under Settings too.

I've whitelisted a couple of sites too, PINGing them to get their IP.

Brilliant!

Only problem is - doesn't seem to make any difference in OWB. All the sites are loading happily as normal. Tried resetting etc. Also tried 127.0.0.1 instead of 0.0.0.0. Hmmm. What am I doing wrong?