The pie chart on the right shows a country-based distribution of the blacklisted prefixes. The geolocation of the prefix is fetched from the GeoLite data created by MaxMind and is derived from the announcements received from within the BGP routing system. The BGP routing data used is made publicly available by RIPE NCC's Remote Routing Collectors (RIS).
It's possible that a prefix may be used from locations encompassing multiple countries. In such a case, the prefix is made to fall in a country with the highest coverage. Ideally, each location of the prefix should be accounted for to make the distribution more accurate.
The prefix annoucement and geolocation is a dynamically changing process. As a resut, a backend scheduled job is provisioned to periodically update the raw data and regenerate the plots. The periodicity is currently set to a month for now, but we will see if it needs to be tweaked in the future. The pie chart was drawn using the HighCharts javascript library.
The map below shows the geolocation of announced blacklisted prefixes from the BGP routing data collected by RIPE NCC. Click on the marker to see more details. The map was drawn using the gmaps.js javascript library.