Yes, it has to point to something the client knows. Android uses a
gstatic.com link.

The key is that the client knows to expect a
particular response, but the captive middlebox does not. Thereby the
client can find out whether there is a captive middlebox or not, by
seeing whether it gets the expected response or a redirect.

Arnt