The media keeps updating us on the number of WannaCry infected PCs. Are they all using the information from MalwareTech? How does MalwareTech get this information?
He owns the most of kill switch domains (used to stop the malware execution). One of which I am know to is this where he says "Upon running the sample in my analysis environment I instantly noticed it queried an unregistered domain, which i promptly registered." The number of DNS requests he is getting, he notes that using some auto-script and represents here. He is also getting the ip geolocation on a real-time basis and hence he is able to represent it on a map.
Maybe he is using something more than this to detect if it is from a browser or not to get the actual data.