Oops, you're right. I discovered that it was my browser that was "helpfully" adding www in front of lots of domains I had blocked in /etc/hosts. For instance, if I blocked example.com, my browser would automatically try www.example.com (which might then redirect to something else entirely).

In my case, I'm using Firefox. I can stop this behavior by setting "browser.fixup.alternate.enabled" to "false" in about:config.