Ok, i am impressed how someone can keep track how many rug pulling projects there have been, many of them are not as clear as they are slow rugs and as there is so many ways to rug people, it couldn't be easy job to recognize them, well except maybe the chart, but even with those you can't tell from a chart which project just failed and which rug pulled.
They did not track it manually, it would be impossible noting how many worthless tokens pop out every day. If you look around the report's firm site, it stated that they are using an automatic tool that scans the smart contract. So it must be set with defined scam smart contract characteristics to be incorporated with the tool, with that way, they are able to keep track of any shady tokens.
See
https://www.soliduslabs.com/solutions/threat-intelligence for more reference.