From where does the traffic come ?

I mean you say worldwide, but is it whitehat (you got servers, or something idk) or blackhat (i suppose botnet) ?