These are the results.
Last 576 blocks (1 day):
1: GNDA5MZWcm4AjLtNuEmYpgH8qsxo4vrnY8: 354005.346000 (61.46%)
2: GdDkjtEeKm1r26zhXj6TpHqu3FGDbpHaRg: 122000.288000 (21.18%)
3: GNh1gofrspXQphYuYewW6GDseQ1fss1GRx: 65000.028000 (11.28%)
4: GMnaaMMV66NHmsEVVfik2tGinMQ8nVG1DA: 16830.107910 (2.92%)
5: GYmHKjS6FgiisN4jdHeWizE6fJzerDeaWE: 8910.102960 (1.55%)
Last 1152 blocks (2 days):
1: GNDA5MZWcm4AjLtNuEmYpgH8qsxo4vrnY8: 558007.950000 (48.44%)
2: GNh1gofrspXQphYuYewW6GDseQ1fss1GRx: 285000.345000 (24.74%)
3: GdDkjtEeKm1r26zhXj6TpHqu3FGDbpHaRg: 238000.549000 (20.66%)
4: GMnaaMMV66NHmsEVVfik2tGinMQ8nVG1DA: 29700.113850 (2.58%)
5: GJQiHxaJgfzwH2UKAnNN9WL9FRZsPgcsSx: 17000.005000 (1.48%)
Last 4032 blocks (7 days):
1: GNDA5MZWcm4AjLtNuEmYpgH8qsxo4vrnY8: 1591013.748201 (39.46%)
2: GdDkjtEeKm1r26zhXj6TpHqu3FGDbpHaRg: 1101024.108200 (27.31%)
3: GNh1gofrspXQphYuYewW6GDseQ1fss1GRx: 865013.380000 (21.45%)
4: GTEU63hXhDtGDWyYikoyrTWHM2sUNBL8xV: 225005.238000 (5.58%)
5: GMnaaMMV66NHmsEVVfik2tGinMQ8nVG1DA: 156420.762399 (3.88%)
Conclusion:
I doubt GND is aiming to attack the coin, this miner has been in the network for a long time and if he/she wanted to perform a 51% attack he/she could have already done so already.
GND is probably dumping coins on the market now and then, but that could be explained because those MH/s don't pay for themselves (ah well, indirectly they do)..
Having said that, it would indeed be better for the network to have a evenly divided hashrate. This will take time, as more miners join the network.
For now I don't see a lot of things we can do. KGW is doing it's work nicely, taking the MH/s waves as they come and go.
I'm sure he's not atacking the coin... because it is Hardcore miners having a guest with 400 Mhs. Also pools have a responsibility here, but thats been said many times.