Mystery miner observation

[wiretapped]

Regarding the mystery miner being discussed in https://bitcointalk.org/index.php?topic=67634.200 ... (originally at 88.6.216.9 and now at 85.214.124.168):

A little while ago they mined four blocks in the space of 1 hour:

http://blockchain.info/block-height/171757
http://blockchain.info/block-height/171759
http://blockchain.info/block-height/171760
http://blockchain.info/block-height/171763

Interestingly, the timestamps on their two consecutive blocks 171759 (2012-03-18 19:31:32) and 171760 (2012-03-18 19:31:30) are out of order! This implies to me that either there are some shenanigans I don't understand the point of, or this is a botnet without good clock sync.

Can someone explain what the timestamp field is used for?

ps: someone who isn't limited to the newbie forum, please copy+paste this post to the myster miner thread. edit: thanks, Mushoz!

[splatster]

It is more than possible that blockchain.info simply has the info wrong, though I'm sure there is a much better explanation for this.

[ChiangYay]

It is more than possible that blockchain.info simply has the info wrong, though I'm sure there is a much better explanation for this.

Makes sense

[wiretapped]

It is more than possible that blockchain.info simply has the info wrong, though I'm sure there is a much better explanation for this.

No, I'm talking about the timestamp field which is part of the block, not the "received time" field which is just from blockchain.info's point of view. Blockexplorer.com also shows those two timestamps out of order:

https://blockexplorer.com/block/00000000000008729cb2580c281200c2c2296757def0d8b27f4b7b8a047d4d34
https://blockexplorer.com/block/00000000000000b480d06cbe1c462c76e8ca51587f4c37cf65651d5b47eccfae

In other news, two more IPs have been mining empty blocks in recent days, including two in a row a couple hours ago:

http://blockchain.info/block-height/171806 (relayed by 188.127.227.12)
http://blockchain.info/block-height/171807 (relayed by 213.171.43.151)

Here are blockchain.info's transactions relayed lists for all four of the IPs I've seen mining empty blocks recently:
http://blockchain.info/ip-address/88.6.216.9 (29 empty blocks between March 3 and March 7)
http://blockchain.info/ip-address/85.214.124.168 (62 empty blocks between March 12th and today)
http://blockchain.info/ip-address/213.171.43.151 (9 empty blocks between March 14th and today)
http://blockchain.info/ip-address/188.127.227.12 (6 empty blocks between March 16th and today)

If all four are the same entity, I think they have more than (edit: maybe not) 15% of the hash power now (the amount estimated by https://www.privateinternetaccess.com/blog/2012/03/bitcoin-war-the-first-real-threat-to-bitcoin/ ).

Also worth noting, these IPs are relaying new transactions too, aside from winning blocks.

[wiretapped]

I have a theory, given that all four IPs I mention above are relaying other transactions besides the empty blocks:

The IPs in question could be regular innocent bitcoin nodes, not controlled by the empty-block miner miner at all; they are just relaying transactions and blocks for anyone. The miner is just sending their blocks to this small number of IPs to be relayed to the rest of the network.

Could someone copy+paste this theory to the big thread for me? And can anyone tell me how long the newbie restriction on this forum lasts? edit: I posted to the whitelist request thread. w00t! I am whitelisted now.