Thanks for your response. I know they can track IPs, but this appears to be something different. It hit our clients, and our competitors clients, on the same day.
I am thinking they targeted our vertical for some reason.
Also, many but not all accounts were affected.
Smells like there's more to this story than just "IP volume tracking", since we deal with that and similar volume issues often (like using the same ph# repeatedly for verification).