In this case, at least, honeypots. From the linked page: > Every second, Norse collects and analyzes live threat intelligence from darknets in hundreds of loca

In this case, at least, honeypots. From the linked page: > Every second, Norse collects and analyzes live threat intelligence from darknets in hundreds of locations in over 40 countries. The attacks shown are based on a small subset of live flows against the Norse honeypot infrastructure, representing actual worldwide cyber attacks by bad actors.