NTA has 'Top xx Countries'. How does it recognized this information?
NTA updates the list with releases. We pull the latest information from an online data source. You can manually update data for specific blocks, but that is not recommended.
Blocks of IP addresses are issued to a country or region by IANA. I assume SolarWinds has a database of what blocks have been issued to whom, and it uses this to get the country based on IP. Therefore, it may not be 100% accurate as blocks change hands, and overseas proxies can possibly have an effect on the results as well.
More info on IANA, including IP allocations on the ever accurate Wikipedia:
http://en.wikipedia.org/wiki/Internet_Assigned_Numbers_Authority
Then the next question is how does Orion update its IP to Country list ??