[mrng]

Chrome, too, does three initial lookups on start up to see if ISPs intercept requests that cannot be resolved. It compares the IP addresses of the pages that are returned, and turns the infobox off if they are identical (as this suggests an ISP is intercepting the look ups).

[secure]

It is worth pointing out that Chrome requests randomly generated nonsense, while bogusapple.com is always the same.

[mrng]

Absolutely right - I forgot to mention that in my initial comment.

Chrome's behaviour makes much more sense than Apple's -- who hadn't even secured the bogusapple.com domains for themselves (as Microsoft did with Contoso, for example).

[ben1040]

Interesting writeup about the Chrome behavior:

https://isc.sans.edu/diary.html?storyid=10312

[danielweber]

I remember freaking out over those DNS lookups one day, wondering where the malware was. A coworker told me what was going on and so I could relax.