Each body is a malware family reported to ThreatFox. Its size follows the logarithm of its indicator count, and its colour follows the threat type that dominates it: gold for botnet command and control, pale gold for payload delivery, cool white for payloads. Busier families sit on inner orbits. The long tail of smaller families is the outer belt; indicators ThreatFox could not tie to a family are the debris in low orbit.
Points on the globe are the countries where command-and-control addresses are registered. Hover or step to a family and its countries light, with arcs drawn from the body to each one. Families I have written up carry a ring; the ones quiet in this window wait on the outermost orbit.