"Every second, Norse collects and analyzes live threat intelligence from darknets in hundreds of locations in over 40 countries. The attacks shown are based on a small subset of live flows against the Norse honeypot infrastructure, representing actual worldwide cyber attacks by bad actors. At a glance, one can see which countries are aggressors or targets at the moment, using which type of attacks (services-ports)."
This is pretty interesting to watch. It reminds me of an RTS, especially when there are large bursts of attacks.
So they're just monitoring honeypots right? I can't think of any other way to do this real-time.
They scan every single IP every second.
The submitted title [1] was upworthyesque linkbait, so we cribbed the title from the previous submission of this url [2].
1. "This Site Shows Who Is Hacking Who Right Now – And The US Is Getting Hammered"