This is really interesting data and possibly explains most of the recent gap up in knots usage
Allegedly, 19% of the bitcoin network is now running knots
However, I think I have detected evidence of a sybil attack designed to inflate the number of Knots users
I have annoted part of the "historical nodes" chart available at http://coin.dance/nodes/all
Based on this, I suspect the *real* percentage of Knots usage (subtracting probably sybils) is about 12.3% of the total network -- ~2,710 nodes out of 21,950 nodes.
Still a big deal, but not as big as the current numbers seem to suggest
Discussion
If I recall right, PortlandHODL was bragging about running 96 Core nodes back when he was laughing in that now-famous space where he DDoSed Knots nodes over Comsat. Have you considered that? Maybe the reason Core’s node count didn’t dip is because a bunch of spam apologists are propping it up with their own Sybil attack.
I did consider that. If Core fans were spinning up nodes in response to an ongoing decline in organic users, I suspect it would appear as jerky waves, a sort of sawtooth pattern. But in fact Core's usage line became flat after the initial wave of dropouts, while Knots kept rising; that seems like a weird, inorganic pattern.
Judging by written testimonials I see everywhere, a lot of people that never ran nodes are running Knots now. The net sales of companies like Start9 also suggest that to be true.