Where are you seeing 'Poland in the output'?

>Edit: Nevermind, I see what you mean (on the map). I'd be interested to know too... maybe PL is a big player in their attack monitoring?

I don't think so - when you look at historical data, labels change. Seems like Poland is simply a significant actor in this particular attack.