Oops, I managed to derail this thread. Ah well, with 27 pages, I guess it was only a matter of time.

Maybe related:

Your percentage is wrong, I think you probably mean part?

the last valid datapoint is march 28th. after that the chart very unelegantly shows "0", which is not a real datapoint (no data for march 29th yet, too lazy to adjust the data ranges, sorry 'bout that)

But, very nice graph.
I would like to see it again in a few days to see if the 1tx blocks decrease with the takedown of that botnet.

How long does it take for a block to be spendable?
Maybe you can filter out blocks that are already spent.
Pools must use it to pay out customers, the botnet might be just collecting atm.

Those blocks "from" Eligius are not Eligius blocks.  Eligius like p2pool has a direct payment in the coinbase very easy to spot.

Some time ago "mystery" started relaying found blocks only to major pools to hide the origin.  Blockchain.info only knows who first relayed a block not who mined it.

you're referring to this? http://arstechnica.com/business/news/2012/03/p2p-botnets-the-bigger-they-come-the-faster-they-fall.ars

Reason to possibly be afraid of the 1 tx miner:

Tonight we just had a pair of blocks orphaned on the chain, by the 1 tx miner.  173692 and 173693 were both part of the chain, after nearly an hour without a block on the network.  About 15 minutes later, those transactions reset to 0 confirmations as a 1tx miner published 3 blocks in a row.  At the same time, the 1 tx miner's blocks used timestamps from the past to make their blocks appear older than the active chain.

Now, the 1tx miner didn't execute a double spend this time [my understanding is they would have had to create a new spend to replace their old one to complete a true doublespend, otherwise their previous transaction would still be floating around the network and eventually get confirmed].  However, they just sent the network back in time nearly 2 hours until real miners create blocks that move transactions along.