Thanks for the links.
This "unknown" group: Is it the collection of all solo miners or some pool that isn't known yet?
Also: If this is accurate I don't really know if this is a good state for the network to be in in regards to the decentralization aspect. I mean 90% of blocks and thus transactions are handled by just 17 different nodes, that isn't a whole lot. And it is a number so small that with a little coordination between a few of the pools a lot of different manipulation could be possible.
Although I am aware the network would adapt quickly to such things as people can always choose to pull out their hashing power from the "bad" pools, but still a well timed and quickly performed move could still do some severe damage.
And with the upward spiral of difficulty and needed hashing power the number of nodes that handle the major portion of transactions will decline rather than rise.
I have thought long and hard about these problems. I do believe back in may of 2013 this would happen. Asic Miner had close to 40% of the network. They hashed privately. They could not be a ddos victim . On 3 diff jumps there were ddos attacks on the second third and fourth place pools. All happened with 10-12 hours left before the jump. The network was no longer 60% non Asic mine 40% Asic miner. For those 10-12 hour time periods it was closer to 70% Asic miner it does not show up other then if you look at the blocks they would win in the time of the DDOS attacks . They would double ther block collection.
Since they paid out most of that money/coin in dividends there was a boost …
Any large share holder of Asic Miner would have a real benefit. So anyone may have done those DDOS attacks.
I no longer believe in this danger. I do not think anyone can get a 40% share and boost it with DDOS attacks on the next 3 or 4 pools. Why do I think this because the only way for this to work is that top pool must be fully private.
Right now the top pools are all accessible to miners. You can have auto switching in case of major DDos attacks. You can use solo mining as a last resort. So your danger to a timed ddos attack can be safely handled.
Now if someone invents a new chip for mining that is soooo good 300x better then an asic chip
and builds a massive private pool the problem will happen again.