That's just what I'm trying to find out along with other real-time maps, this real-time map was something a cybersecurity professor taught me

https://livethreatmap.radware.com/ https://cybermap.kaspersky.com/ https://cybermap.kaspersky.com/subsystems

Honeypots and sensornets; telemetry from consumer and enterprise devices.

Checkpoint is a firewall vendor; the devices have considerable visibility of public IPv4 traffic and can report back to the vendor when various Intrusion Detection and Prevention rules are hit.

Other vendors are doing traffic analysis in cloud, so the vendor has an out of band view of malicious traffic flows.