I have tried the followings with similar results:
*.paypal.com
*.paypalobjects.com
paypal.com
paypalobjects.com
https://www.paypal.com
https://www.paypalobjects.com
Also
*.mail.com
*.yahoo.com
Additionaly Paypalobjects uses akamaiedge.net for content (add 'ip hotspot walled-garden add dst-host=*.akamaiedge.net action=allow),
when your run command,
dig http://www.paypalobjects.com
; <<>> DiG 9.3.4 <<>> http://www.paypalobjects.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47735
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 13, ADDITIONAL: 0
;; QUESTION SECTION:
;www.paypalobjects.com. IN A
;; ANSWER SECTION:
http://www.paypalobjects.com. 300 IN CNAME http://www.paypalobjects.com.akadns.net.
http://www.paypalobjects.com.akadns.net. 300 IN CNAME http://www.paypalobjects.com.edgekey.net.
http://www.paypalobjects.com.edgekey.net. 21600 IN CNAME e120.g.akamaiedge.net.
e120.g.akamaiedge.net. 20 IN A 88.221.0.146
Yeah, the above works to load the paypal login page correctly. I still dont know where the rest of the command go 
Thanks sergejs
It means that HotSpot is working fine now.
Do you have any problems with any other pages and/or walled-garden ?
Working great for now (currently trying beta10) Thanks heaps sergejs. you’ve been helpful!