My reading of the chart is that knots is up 4k since the drama/campaign started while core is down 1.5k. That would be 1.5k nodes that switched to knots and 2.5k nodes that got added using knots. Now if you want to make it look more organic, maybe ask Chainalysis to switch 10k of their nodes to knots? Or in preparation for the next drama, get some 10k IP addresses to point to your core node? 🤔