I looked through the source code. Not totally sure, but it appears they use the current time to dynamically load events from this API: http://cybermap.kaspersk

I looked through the source code. Not totally sure, but it appears they use the current time to dynamically load events from this API: http://cybermap.kaspersky.com/data/events/1.json http://cybermap.kaspersky.com/data/events/1.json (where "1" would be replaced with some time value) Edit: investigating a bit more, there are 24 URLs for http://cybermap.kaspersky.com/data/events/<H>.json http://cybermap.kaspersky.com/data/events/<H>.json where <H> starts at zero. So you can see if tomorrow the files are all different. It could very well be near-time, maybe with 1 hour of lag/caching.