dns lookup specified in /etc/hosts and then dscacheutil != differ from dig, host, chrome
This command will tell you which process is making the changes to your hosts file:

sudo dtrace -qn 'syscall::open*:entry /arg1&amp;3/ { printf("%d %s %s\n", pid, execname, copyinstr(arg0)); }' | grep hosts