Apple (foolishly) used to use something like
http://apple.com/hotspot
on their main site itself, which meant that using a VPN on demand could
never protect
apple.com because the iphone had to leave that domain out
of the vpn trigger list or else all hotspot detection would be broken. It
seems they have switched to
captive.apple.com with returns "Success".
Nowadays they randomly? choose from several different domains. See e.g.