I tried to sniff the http calls by setting up a proxy on my laptop in the same LAN as the iPhone. Once that was set up, I entered different numbers that I know have iMessage enabled into the number field of the Messages app, but couldn't see any calls being made.
Of course, the proxy was functional as I could see other calls go through such as Safari, App Store etc. Also, these numbers were not in my address book originally.
According to How does iMessage know that the recipient is an iOS 5 device? - iPhone makes a call to Apple servers to determine whether the recipient is an iOS 5 device or not.
What is this API call being made to see if a phone number has iMessage enabled?