Considering clearbit started at a time when there was not so much focus on privacy and customer data protections... I’m gonna take a wild guess here and say the

Considering clearbit started at a time when there was not so much focus on privacy and customer data protections... I’m gonna take a wild guess here and say they are scraping it from publicly available (ish) sources. That is discounting the obvious possibility of looking at ARIN allocations, where in some cases the IP address might be registered to an ASN belonging to the company. In that case it’s a simple lookup.