Those listening nodes still need to connect to the network. They usually, on first start, will connect to a DNS Seeder and ask it for some nodes to connect to. Generally these nodes are ones that have high uptimes and high bandwidth. The seeder will also record some information about the node that asked it for data in case it is a listening node so that it can send nodes to connect to that node as well. So there are then two ways to get information about non-listening nodes; run a DNS seeder, or operate a high uptime, high bandwidth node that gets lots of connections.

The second method doesn't really work that well since Bitcoin Core puts a maximum of 125 connections so it can't actually get thousands of nodes connecting in order to get accurate data. What Luke-Jr does is he operates a DNS seeder and builds his information off of there.

The DNS seeders are hard coded into the software. There are currently 6 DNS seeders, one of which is Luke-Jr's.