I should probably not be surprised but the vast majority of brute force connx to my mail server actually comes from 2 ISPs. That's quite unlike my experience with SSH brute force which i guess is more widespread.

One is a Yandex subsidiary in London, the other is Turkish. I really dislke whole subnet blocks but in this case I can live with it.