Right before writing this question I noticed the GHashIO showing 32% hashrate distribution using the following link.
Unknown has 26%. And the IP address of the most blocks reported from unknown is: 88.150.205.243. After doing some digging it seems that the IP address is owned by GhashIO according to totalhash.
Not sure how reliable the data from totalhash is but it seems that GHashIO has already achieved above 51% total hashrate. Can someone confirm this? If it's false then what would be the proper way to investigate this in the future?