Probably. I was trying to figure out if it could be done with an address family translation, and while ip4 is trivially embedded in an ip6 address, going the other way just does not have enough information. but if you know the domain, that is a simple lookup.

The fun part is, with a dns entry like that they could technically get certs issued for peoples domains if they wanted to. I will be charitable and assume it is just a neat relay someone put together, but they could get up to some real shenanigans if they had a malicious bent. Really nothing worse than cloudflare where much their business is ssl hijacking(correction)termination.

Probably no need to guess at all. If it's given a domain, it can perform a DNS lookup for the domain - if its A entry matches, it can tunnel to the IP that the respective AAAA points to. Clever.