Actually (after contacting their support because of wrong data that was returned for my contact), they seem to be using https://clearbit.com/ instead as backend.

enrich.email also does the same, though.

There’s also https://fullcontact.com.

In the end they all just search and scrape social media profiles and gravatar.