There is an underwriting syndicate that has been allocated shares before hand. Those syndicate members may have also promised an allotment to VIP customers and owners.
Basically...
The syndicate group and leads places the allocated shares with large institutions/asset managers, some wealthy individuals, family offices, other subscriber types. Usually in order to continue to get [good] allocations from syndicate banks, they have to promise not to sell or unload for an allotted time- 30 days, so it's unlikely many of these players who are selling days 1-3, but some do and they are a portion of sellers. Conversely, as part of the syndicate/selling(placement) group they take some "risk", by placing stabilizing bids to make sure prices don't collapse well before ipo priced deal.
Also, getting borrows is usually impossible for a new listing until shares settle with custodians (t+2 usually), so it's unlikely its speculators going short without locates.
In summary it is usually either market makers who buy during the live trading (possibly in the opening auction if they like the prices, but not usually ones from the allocation). Usually previous equity owners (founders, owners, PE/VC investors) are the ones NET selling- as they are the ones who are bonafide long and could provide net selling pressure along with some of the IPO subscribers who are flipping- the market makers/speculators would be net flat or net long until shares are available in 2 days to be able to go short.
Also note that some IPOs allocate shares to special interests- think important customers or community, which usually can sell the shares immediately as they don't have to "play nice" with the syndicate allocation, but are allocated from the company IPOing.
