For HTTP connections, and probably also some other protocols, your browser(or other client) will put the domain name in the
Host: header. For example, a request might start something like this:
GET / HTTP/1.1
Over an unencrypted connection, this would reveal the target domain.
For TLS connections (most commonly, HTTPS), most clients will specify what host they want to connect to (this feature is called SNI, and is used in case the same IP is serving multiple domains) in plain text. The server will respond with a certificate that contains the domain name (whether or not the client is using SNI), and this certificate is also transmitted in plain text; anybody eavesdropping on the connection can read traffic in either direction. The certificate may specify multiple domain names, which are usually subdomains of one root, or multiple domains owned by one company.
Also, reverse DNS is a thing. If somebody wants to know what domains you're communicating with, and those domains are registered in DNS, then they can do a reverse lookup on the IP addresses. Just as a normal DNS lookup maps a name to an IP, a reverse lookup maps an IP to a name. Again, there may be multiple domain names that all map to that IP, in which case the reverse lookup will return multiple names, but they're usually related.
There are also tools that explicitly interact with DNS (and therefore send domain names over the network), like
whois. However, those aren't things you'd usually use on a site you know well enough to have in your Hosts file.