A new report out today from cyberfraud protection startup DataDome SAS warns that surging demand for DDR5 memory, fueled by the artificial intelligence boom, has triggered a wave of automated scalping activity that is overwhelming online retailers and distorting supply.

The report details how bots are now hitting DDR5 RAM product pages nearly six times more often than legitimate users and benign bots. In one campaign, fraudsters were observed generating more than 50,000 scraping requests per hour. Across the broader activity set, more than 10 million scraping attempts were blocked as attackers sought to monitor inventory and pricing in near-real time.

AI is the root cause — more specifically, AI’s insatiable appetite for memory. Training large language models, running inference servers and supporting always-on AI workloads require massive amounts of RAM capacity. Amid the ongoing AI boom, that demand is pushing the price of high-performance DDR5 modules sharply higher.

Thrown into the mix is that manufacturers have also shifted production toward higher-margin server-grade memory for data centers. That has tightened the supply of consumer-grade modules and created the kind of scarcity that attracts arbitrage.

In a one-hour sample detailed in the report, 91 unique DDR5 product listings were scraped an average of 551 times each, equating to stock checks for a specific RAM kit roughly every 6.5 seconds. According to DataDome’s Galileo threat research team researchers, the pattern strongly suggests automated price monitoring systems designed to purchase inventory instantly and resell it at inflated prices on secondary markets.

The bots observed were not limited to scraping consumer-focused brands such as Corsair Gaming Inc., Crucial (Micron Technology Inc.) and Kingston Technology Co. Inc. But it also targeted industrial and original equipment manufacturer providers, including suppliers of DDR5 SDRAM, server modules and even hardware components such as DIMM sockets. The scalping pressure is affecting the entire DDR5 ecosystem, ranging from raw components to finished retail kits.

DataDome’s researchers also observed efforts to evade detection, with nearly every request including cache-busting parameters to avoid being served cached content.

Sessions consisted of a single page hit followed by an immediate exit, with no cart activity or search behavior. Traffic patterns followed a human-like day-and-night rhythm but maintained flat, highly calibrated peaks that hovered just below typical volumetric alarm thresholds, which suggests that the attackers have tuned their scraping speed to avoid triggering defenses.

The report concludes by suggesting that traditional IP blocking and simple rate-limiting are increasingly ineffective against such operations, particularly when bots operate through legitimate infrastructure.

“Traditional security measures that rely solely on IP reputation or simple rate-limiting are virtually blind to these modern attacks,” the researchers write. “If a WAF simply blocked IP ranges to stop this attack, it would break legitimate services and block real users.”

The researchers argue that advanced behavioral analysis is now required, analysis that is capable of identifying impossible traffic consistency and 24/7 precision.

Image: SiliconANGLE/Ideogram