DDR5 scalper bots now outnumber shoppers 10 to 1 — automated scraping hits listings every 6.5 seconds as 32GB kits surge from $72 to $392, DataDome researcher says

Crucial DDR5 Pro memory — (Image credit: Micron)

Bad bots account for 91% of the traffic reaching one retailer's DDR5 memory product pages, roughly 10 automated requests for every legitimate visit, according to a LinkedIn post this week from Jérôme Segura, VP of threat research at bot-mitigation firm DataDome. The figure updates research DataDome published in March, which measured the ratio at about 6:1 across several e-commerce sites.

Over the same period, the cheapest 128GB DDR5-6400 kit tracked by Tom's Hardware has reached $3,399, ten times its record low pricing. The Thales 2026 Bad Bot Report puts bad bots at 40% of all web traffic, less than half the share Segura reports on DDR5 listings.

DataDome's March report documented a single operation that generated more than 10 million blocked requests, with a one-hour sample showing 91 DDR5 listings each polled around 551 times, or once every 6.5 seconds. The requests carried cache-busting parameters to defeat cached stock data and targeted industrial module makers such as Micron and Apacer, as well as DIMM socket suppliers Amphenol and TE Connectivity, alongside consumer brands.

Latest Videos FromTom's Hardware

Watch full video here:

Segura wrote on LinkedIn that retailers carrying memory should assume their "traffic analytics are probably understating the problem significantly."

Scalper bots now outnumber human shoppers 10 to 1 on one retailer's DDR5 pages, DataDome researcher says — (Image credit: DataDome)

Keep in mind that the 91% figure comes from one unnamed retailer, and DataDome hasn't published a sample window or its methodology. DataDome also sells the product that blocks this traffic, and page requests ultimately aren't purchases, so the ratio measures monitoring pressure on listings rather than how much stock bots actually end up securing, which can’t easily be quantified.

Apacer CEO C.K. Chang said in July that DRAM supply to independent module makers could fall to 30% of 2026 levels next year, and TrendForce expects conventional DRAM contract prices to rise another 13% to 18% in Q3 after roughly 60% in Q2. Hyperscale buyers have reportedly placed deposits against most of 2027's DRAM output.

A 32GB DDR5-6000 kit that averaged $72 this time last year now averages $392 on PCPartPicker. While graphics card and console scalping in 2020 and 2021 ran against scheduled restocks that eventually outpaced resale demand, no equivalent restock date exists for consumer DDR5 before 2027 at the earliest.

Framework stopped selling standalone RAM in November last year, citing scalpers, and Micro Center sells its CPU, motherboard, and 32GB DDR5 bundles in-store only with a one-per-household limit. Newegg and Amazon have run repeated CPU-plus-memory bundles that price a 32GB kit well below its standalone cost, which ties each kit to a processor a reseller then has to move as well. On eBay, we found G.Skill's Trident Z5 Neo 32GB kit listed at $836.54 in December against a $429.99 retail price, roughly double, and about seven times the $117.99 it sold for before the shortage.

Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.

TOPICS

Luke James is a freelance writer and journalist. Although his background is in legal, he has a personal interest in all things tech, especially hardware and microelectronics, and anything regulatory.

29 Comments Comment from the forums

DawnofWar411

The scalping solution has been in front of retailers faces for years:
Pharmacies across the country can limit purchases of basic cold medicine just by tracking driver's licenses. The same software could easily be used for purchases of anything else online.

That would require effort on the retailers part and actually caring enough about the consumer, so we'll never see a change here.
Reply
PEnns

DawnofWar411 said:
That would require effort on the retailers part and actually caring enough about the consumer, so we'll never see a change here.

Exactly. They are too busy doing the official scalping.
Reply
PirateBlis

Surprised that there isn't an international law complete with fines against this already.

Not only is it contributing to inflated pricing, strong arming normal customers, and contributing to the scalping issues that plague many industries, but the biggest thing people aren't realizing is the amount of incurred costs by the site/retailer due to increased traffic/data draws.
Reply
catlady101

I would like them to publish the data on this not just the summary.
It would be good to be clear on what criteria they are using to define a " bad bot" and how they gather that information.
I have seen sites treat users with a vpn as " bots" so their definition is important, although I have no doubt that the chips are a highly sought after commodity at this time, I would like to see how they measured the parameters to define 91% of traffic as bad bots and if traffic is traffic and not just page views.
Reply
tudos4

DawnofWar411 said:
The scalping solution has been in front of retailers faces for years:
Pharmacies across the country can limit purchases of basic cold medicine just by tracking driver's licenses. The same software could easily be used for purchases of anything else online.

That would require effort on the retailers part and actually caring enough about the consumer, so we'll never see a change here.
The pharmacy comparison doesn't really map onto what this article is describing.

First, pharmacies aren't generally tracking driver's licenses to limit purchases of "basic medicine." In the US, that system specifically applies to drugs containing pseudoephedrine/ephedrine and similar substances because federal law restricts them due to their use in meth production.

More importantly, the "10 to 1" figure here isn't ten scalpers buying RAM for every real shopper. It's roughly ten automated web requests for every legitimate visit. DataDome's own analysis(https://datadome.co/threat-research/scarcity-ddr5-ram-fueled-by-ai-demand-scalping-surge/) describes bots repeatedly scraping RAM product pages, often with one page hit and no interaction with the cart or search.

Checking a driver's license at checkout therefore wouldn't stop most of the activity producing that 91% figure. Purchase limits and better anti-bot measures can certainly help against bots that actually try to buy up stock, but requiring government ID for ordinary computer hardware would also create significant privacy and data-security issues.

Retailers can probably do more, but this isn't quite as simple as reusing the pharmacy system.
Reply
kuramakitsune

DawnofWar411 said:
The scalping solution has been in front of retailers faces for years:
Pharmacies across the country can limit purchases of basic cold medicine just by tracking driver's licenses. The same software could easily be used for purchases of anything else online.

That would require effort on the retailers part and actually caring enough about the consumer, so we'll never see a change here.
And that's exactly where the black market of all those stolen credentials comes into play they just use a million different people's driver's licenses and make their orders there's no way a dumb system can weed out someone's copied driver's license versus someone's legitimate one
Reply
OffMyRocker

Smells like the NVIDIA scam Jays2cents uncovered during the pandemic.
Reply
rluker5

catlady101 said:
I would like them to publish the data on this not just the summary.
It would be good to be clear on what criteria they are using to define a " bad bot" and how they gather that information.
I have seen sites treat users with a vpn as " bots" so their definition is important, although I have no doubt that the chips are a highly sought after commodity at this time, I would like to see how they measured the parameters to define 91% of traffic as bad bots and if traffic is traffic and not just page views.
I've used that site nowinstock to track down an available 3080 during a crypto boom and an Optane 900p drive a couple years prior and still have both. Sounds like that site might be lumped in with the "bad bots"
Reply
Roland Of Gilead

catlady101 said:
I would like them to publish the data on this not just the summary.
It would be good to be clear on what criteria they are using to define a " bad bot" and how they gather that information.
I have seen sites treat users with a vpn as " bots" so their definition is important, although I have no doubt that the chips are a highly sought after commodity at this time, I would like to see how they measured the parameters to define 91% of traffic as bad bots and if traffic is traffic and not just page views.
100%
Reply
Love20044

This is what happens when you rush out products ddr3 should be just as good as ddr4,yes I know a lot of people will cry but who cares all of the chips are going into drones and bombs anyway and ddr5 you should just skip to ddr 6 phase out the 5 leave ddr 3and 4 on the deck for at least 6 to 7 more years stop making ddr5 period or stop selling it till you have enough and start back just selling ddr3 and ddr4
Reply

Show more comments