Lots of traffic with query string ?ssp_iabi=1677XXXXXXXX

Any one else seeing a lot of traffic with a query string like ?ssp_iabi=XXXXXXXXXXXX where Xs are a bunch of numbers. Parameter is always "ssp_iabi" Any one know what this is? SSP is supply side platform so some ad related thing run amok?

---

I am seeing this across several unrelated WordPress sites hosted on different servers in different datacenters owned by different people so this is not some targeted DoS. They are in similar content areas but the most significant thing they have in common is they all have display advertising on them. Requesting IPs are all over the place including ones owned by Pinterest, Google, AWS, GoDaddy US and Europe, random smaller ASNs.

There is at least a dozen user agents, Pinterestbot user agent goes back to Pinterest IPs on lookup, Google Mediapartners agent IPs go to Google LLC, many other smaller crawlers I have seen in logs before that trace back to AWS or GoDaddy or random smaller datacenters I haven't heard of. Ipv4 and ipv6 addresses.

It's just really strange they are all using the same parameter in a coordinated fashion but seem like they must be separate actors with what appear to be legit Google Mediapartners bot and Pinterestbot IPs. It must all be related to the advertising but why are they all going nuts with the same parameter and loading hundreds of thousands of pages (multiple loads of same page but many different pages across sites) a day on some of these sites. Started 2/21 and load was greater today 2/22.

 

Still seeing tons of traffic with this querystring. I had originally added it to the ignore list of my cache plugin and that cut the server load caused by it in half but, then the plugin was generating cache pages with that querystring and filling the disk.

I got smart and used a Cloudflare transform rule to strip the querystring so it is treated just like any other request since I'm not ready to block the requests yet.