[jsmith45]

When behind a captive portal, you need to load some page over http to allow the device MITM you. Nice devices will have built in captive portal checking, but not all devices are built nicely.

On some devices typing “neverssl.com” will try to resolve https://neverssl.com without any form of http fallback. It may be actually pretty difficult to type :// on some devices too.

On these devices, if you ever visit “neverssl.com” when not behind a captive portal, you will get a a catchable redirect to http.

Then the next time you are behind a captive portal, if you type “neverssl.com” the browser resolve it to https like always, but will remember the cached redirect, and try to load the http version, letting you land at the captive portal page.