It's hard to judge whether what is on this page indicates anything without some reference or historical data.

Here's something that I've always wondered: Where do they get this data?

In this case, at least, honeypots. From the linked page:

> Every second, Norse collects and analyzes live threat intelligence from darknets in hundreds of locations in over 40 countries. The attacks shown are based on a small subset of live flows against the Norse honeypot infrastructure, representing actual worldwide cyber attacks by bad actors.

Probably backscatter?