if its really botnet , new PoC coin will have a hard time fighting them. They pretty much own the whole network. It's not easy to build up network size for the first couple of weeks. Therefore, botnet is consider good news ? Botnet will be a good anti clone ? Or perhaps those botnet owner is burst developer ?
it is a human being (with > 100 accounts, cloned and prepared in advanced in quite premeditated way, but by a person probably with access to some VPS at a BIG expense or he/she managed to inject plots in illicit way and bypassed sys admin audit), and he is closely watching your reactions, CPU coins botnets are proven to exists, POS type of botnets I can not imagine being the case, someone made me laugh here suggesting utilization of browser html5 storage , funny.. botnet would have to in stealth inject massive plot file and do so without system admins knowing that (and storage is valued and monitored) maybe some data center(s) failed to notice their storage being suddenly depleted lol
now there are botnets runnins on exchanges manipulating prices of many alt coins , that is a separate problem
anyways interesting drama is unfolding here , stopping calling him/she an idiot because there is nothing wrong with making money, it is just that he/she might lose shirt in the process before that happens
all you need to do is plot a small file (relatively speaking), say 50 GB. so 100 computers can add up to 5TB and 1000 bots give you 50TB. this is a low back of the napkin estimate.
but a "smart" operator would code it up so that it takes up say half of available disk and with large drives out there, you're talking several hundred GB per plot file are very likely. you can plot say a 1000 files across 1000 computers all for 1 account you can have them setup in proxy/pool mining.
the large swings could be computers being turned off and on in different time zones? once a file is plotted, mining is pretty much unnoticeable.
anyway, this is possible, but I'm probably wrong
but the network size oscillates 15T then 8T and 7T then back up again... and all at once all these computers would have to turn on and off at the same time
drama continues
also we can not tell IP (because it is solo) if "it" would connect to the pool, would be different we would know immediate what is going on
also not just weekend, weekdays too, workplace possibly , supercomputing data center and virtual attached storage partitioned, plots sneaked in (but not the full) also I would expect to be 20P right now and growing if unlimited, so there is a definite limit to what "it" is doing, pretty funny all this, at 20 P all others mining activities would halt to the stand still.. so that is why "it" might also not do it (oscillations are like giving a carrot, teasing), yeah folks "IT" is playing you all like a violin
also "IT" might be moving plots around (which takes time) to avoid detection