I thought the way these Wifi hotspots worked was that they intercepted all DNS traffic? How else would they work with legacy systems?
Modern OSes detect these login pages by making a DNS lookup of a known domain, eg. macOS/iOS lookup "captive.apple.com", and if the answer is not in the 17.0.0.0/8 subnet they know someone is intercepting DNS and show the Wifi login window.