Probably no need to guess at all. If it's given a domain, it can perform a DNS lookup for the domain - if its A entry matches, it can tunnel to the IP that the respective AAAA points to. Clever.
There's significant amounts of traffic going through transfer stations [1], which is then re-sold to the model labs. For a while the DeepSeek API was serving Fable as the DS 4 Pro model even. [2]
I remember sitting in class in school, writing out programs on paper for me to try out at home