from my S6 with Android 7, non rooted, it will try to reach the following
http://connectivitycheck.gstatic.com/generate_204
and it expects to get an empty but valid 204 response, e.g.
root@kali:~# curl --verbose http://connectivitycheck.gstatic.com/generate_204
* Trying 172.217.27.99...
* Connected to connectivitycheck.gstatic.com (172.217.27.99) port 80 (#0)
> GET /generate_204 HTTP/1.1
> Host: connectivitycheck.gstatic.com
> User-Agent: curl/7.56.1
> Accept: */*
>
< HTTP/1.1 204 No Content
< Content-Length: 0
< Date: Wed, 21 Mar 2018 14:06:19 GMT
<
* Connection #0 to host connectivitycheck.gstatic.com left intact
root@kali:~#
but if there is a captive portal in the middle it will receive some sort of 200/OK instead. In the case of aruba, that would look like the below - the important thing is that its not an empty 204 response, which is how it knows to pop up the mini browser thing
HTTP/1.1 200 Ok
Date: Wed, 21 Mar 2018 14:01:23 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
X-UA-Compatible: IE=edge;IE=11;IE=10;IE=9
Expires: 0
Content-Length: 168
Connection: close
Content-Type: text/html
<html>
<head>
<meta http-equiv='refresh' content='1; url=http://connectivitycheck.gstatic.com/generate_204&arubalp=68a501fb-e8af-4f54-bce2-73a1dc7577'>
</head>
</html>
[edit: I just saw you're on IAP, I don't know if IAP can do this, the below would be true for a controller, leaving it here for completeness]
if you wanted to do something with this, create a named netdestination and acl to use it as you see fit (the IP to name will be filled by dns snooping)
netdestination connectivitycheck
name connectivitycheck.gstatic.com
!
ip access-list session android_cp_thing
user alias connectivitycheck svc-http <whatever>
user alias connectivitycheck svc-https <whatever>
!
hth