They did not track it manually, it would be insane noting how many worthless tokens pop out every day. If you look around the report's firm site, it stated that they are using an automatic tool that scans the smart contract. So it must be set with defined scam smart contract characteristics to be incorporated with the tool, with that way, they are able to keep track of any shady tokens.
See
https://www.soliduslabs.com/solutions/threat-intelligence for more reference.
I didn't claim they would do it manually, i just implied that there are several ways to do a rug pulls, like for example a slow rug pulls where devs just don't keep up with the roadmap or deliver anything meaningful and slowly leave the project to die. That would be hard to recognize by a bot when it takes sometimes over a year for users to realize it.
But thanks for the link, that's interesting read.
Exactly. There might be so many changes along the development road. Devs don't keep up with the roadmap or deliver any meaningful update. I rarely see any tech team that will complete tasks to the end. If we take these into consideration, the scam number will be much higher.