At one point, Avalanche network was responsible for two-thirds of all phishing attacks.

Source: Legal raids in five countries seize botnet servers, sinkhole 800,000+ domains | Ars Technica