Because mallory.com (who's impersonating valery.com by ripping off the site design, and has a valid certificate for mallory.com) is running a full-up copy of Ch

Because mallory.com (who's impersonating valery.com by ripping off the site design, and has a valid certificate for mallory.com) is running a full-up copy of Chrome in a VM, and is clicking the signin link just like a user would do. I assume what Duo is referring to, though, is that they send through the IP address that your push request is coming from. So if a user is observant and knows their public IP, they should see the difference.