One possible answer: if the phone app is a native app, it could be listening on a HTTP port and sending the phone's network information to the webserver, which then tells the webapp to ping the phone app, and then the phone uses reverse-mDNS to get the hostname.

I'm not sure why they would go to the trouble of getting the web app to talk to the phone app directly, but it is possible.