Digikey website, bot detection - Page 1
Forum section: electronics / general

author: SiliconWizard
author_rank: Super Contributor
timestamp: September 11, 2025, 02:23:57 pm
content: Today, the Digikey website has become basically unusable on my side due to their new bot detection protection.Am I the only one affected?

author: UnijunctionTransistor
author_rank: Frequent Contributor
timestamp: September 11, 2025, 02:37:38 pm
content: I currently have an open Digikey page as I type this and have absolutely zero issues.

author: NE666
author_rank: Frequent Contributor
timestamp: September 11, 2025, 02:57:20 pm
content: Also no issues with digikey today (either .com or .co uk).However CPC (Farnell UK) has been down since mid-morning UK time.

author: themadhippy
author_rank: Super Contributor
timestamp: September 11, 2025, 03:34:35 pm
content: Quotebeen down since yesterday here, there aware of the issueQuote

author: Cyclotron
author_rank: Unknown
timestamp: September 11, 2025, 03:50:27 pm
content: Quote from: SiliconWizard on September 11, 2025, 02:23:57 pmI've been seeing issues with Digikey off and on for the last couple of weeks.At one point, I wasn't able to add parts to a cart at all. See the image attached. I reported it to Digikey.Mouser has been a mess for me, too. I ordered yesterday with a 45-minute cutoff, and they still haven't shipped. They need to just change that cutoff time.

author: peter-h
author_rank: Super Contributor
timestamp: September 11, 2025, 04:17:55 pm
content: Digikey have implemented a captcha some months ago (at least).Even Mouser have done that but I seem to get it a lot less.I don't know why this is. Any publicly visible website is attacked continuously. You publish any DNS and within an hour the Chinese will be there, running huge dictionary attacks. You can eliminate some 90% of that traffic by firewalling China, Russia and India, and I have done that for certain sites whose content is inapplicable to the 3rd World, but these sites presumably do want that business. I would expect Digikey to be hit by bots at 1kHz to 10kHz, which (even returning Error 404) is a significant server CPU load.So it may be something else, and it is probably a measure to prevent scraping aimed at creating pricing comparison site(s). I am dealing with heavy scraping currently on a couple of sites I run.There is also nowadays a lot of traffic due to AI bots scraping. If you put your site behind Cloudflare they can block that, as well as any bots other than very slow ones, but a firm like Digikey would be paying 10k-100k per month to Cloudflare for that protection. I am managing with the free version of CF but those are nonprofit sites so this is OK. CF is actually an amazing facility, allowing captchas to be presented according to complex criteria.

author: ataradov
author_rank: Super Contributor
timestamp: September 11, 2025, 04:29:27 pm
content: I'm on VPN and it is 100% unusable.Mouser will sometimes block me mid search. Often when I do multiple filtering parameters selection. I guess their site is so poorly coded that it generates a ton of requests to update the results, and bot detection detects that increased traffic.

author: Cyclotron
author_rank: Unknown
timestamp: September 11, 2025, 04:55:57 pm
content: Quote from: peter-h on September 11, 2025, 04:17:55 pmCAPTCHA is 100% useless. Defense.net (Shape Security), showed this several years ago. Computers are faster and more accurate at solving CAPTCHA than humans are.https://www.usatoday.com/story/tech/2023/08/17/captcha-tests-keep-more-humans-than-bots-out-study-shows/70609691007/The issue I take with Cloudflare is that they do not appear capable of recognizing "good bots". Especially retail sites have at least 3 primary categories of bots an many sub-types. Being judicious a site would want to select down to make use of beneficial bots/crawls so they are popping in the right searches.

author: SiliconWizard
author_rank: Super Contributor
timestamp: September 11, 2025, 05:05:58 pm
content: Still doing it. Attached is a capture. Happens repeatedly. Validating the thing requires holding the button for ages and it will pop-up again when accessing another page. That's fully broken.

author: David Hess
author_rank: Super Contributor
timestamp: September 11, 2025, 05:45:48 pm
content: Just logged into my Digikey account and browsed and had no problems.

author: Cyclotron
author_rank: Unknown
timestamp: September 11, 2025, 05:58:22 pm
content: Quote from: SiliconWizard on September 11, 2025, 05:05:58 pmThis is the bot/WAF protection from a firm called PerimeterX that was acquired by Human.It annoys the crap out of legitimate customers. I get that pop up on Digikey from time to time too.For those with illicit intent, it is easy to circumvent.https://www.zenrows.com/blog/perimeterx-bypassThe above is just the part that is open. There's services with APIs that you pay pennies per thousands of solves to for these things.Companies need to wake up and use something that works. I've seen the reports from these companies though.These companies demonstrates to its customers that these "reports show all the bad stuff we blocked for you" and since the person they are presenting it to was likely the person that selected it, they don't challenge it.

author: NE666
author_rank: Frequent Contributor
timestamp: September 11, 2025, 06:08:55 pm
content: Quote from: themadhippy on September 11, 2025, 03:34:35 pmSounds as if a J. C. Bamford cable detector has struck again.

author: Cyclotron
author_rank: Unknown
timestamp: September 11, 2025, 06:32:22 pm
content: Quote from: NE666 on September 11, 2025, 06:08:55 pmFarnell.com andwww.farnell.co.ukboth point to the same IP. Seems the IP belongs tohttps://www.lumen.comThe "www" property and the "uk.farnell.com" names use Akamai's caching network so that might be why they remain up.I can't imagine a significant web properly being ran today without redundant and diverse ingestion links. Heck, where's the disaster recovery?

author: thm_w
author_rank: Super Contributor
timestamp: September 11, 2025, 10:05:31 pm
content: No bot issues but there are problems loading images. edit: images work better in chrome?I wish they could just greenlist your IP and link it to your account or something, if you have ordered from them, and not flag it again unless you are using excessive bandwidth. Maybe that is already part of it though.

author: Cyclotron
author_rank: Unknown
timestamp: September 12, 2025, 02:19:40 am
content: Quote from: thm_w on September 11, 2025, 10:05:31 pmThat reminded me of something I was going to mention.One thing that will trigger a lot of bot/WAF/security is the use of VPN and private browsing with TOR. TOR is notoriously used by bot networks, and sourcing through that will trigger a lot of systems.VPN is a "depends" thing. If you use something like Proton, it's not likely to have as much trouble as cheaper alternatives. The VPN systems funnel so much traffic that there's bound to be infected systems with bots running on them.Hopefully, corporate VPN isn't experiencing those problems, or the InfoSec team isn't doing its job.

author: Whales
author_rank: Super Contributor
timestamp: September 12, 2025, 03:22:23 am
content: One of the interesting "bot" detection trips: my user agent claiming to be a slightly out of date version of firefox.(No I'm not salty!)

author: Cyclotron
author_rank: Unknown
timestamp: September 12, 2025, 04:44:31 am
content: Quote from: Whales on September 12, 2025, 03:22:23 amThat is interesting. I know companies that use LTS browsers that would appear "out of date," given they are way behind what's current.I regularly work on the technology, and the most common problem is that administrators get a little too far over their skis.This is likely the cause of what I've seen on Digikey's site lately.

author: peter-h
author_rank: Super Contributor
timestamp: September 12, 2025, 12:38:52 pm
content: QuoteExactly.VPN use is a strong indicator of some dodgy behaviour (or intent) because 99.9% of people don't care about privacy. Same with TOR endpoints. Also, if you run a community site, nearly all these people will turn out to be weirdoesActually a lot of Proton users are slightly weirdQuoteWhy would people be doing that?QuoteThe problem is if somebody is terminating a VPN on a "server farm", e.g. Hetzner, and since these server farms are used to host a lot of bots and scrapers, but almost no "internet user" will be on any of their IPs (since they are not ISPs), it is probably good practice to firewall server farms. For example I have firewalled Hetzner, Tencents, and a few others, and the malicious traffic on my sites has dropped by 90%. Of course I also firewall China Russia India.Yes sure you can circumvent captchas. The OCR part is trivially done with some unix utilities for OCR; it's all ready made. I once paid a guy to code a graphical puzzle, presenting two numbers (as images) and asking for their product e.g. 3 x 6 = 18. Then a friend, whose job is a paid hacker for a security firm, solved it in minutesBut a good captcha does a bit more which is hard for a bot to get around. I've seen the Cloudflare captcha pretty well bugger up some scrapers.What Digikey are doing is dumb and a PITA, but it is also reckoned to be poor practice to identify a user prior to a login (i.e. using just cookies). But I think they are doing this for scraper defence, not to reduce their server bandwidth.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: September 12, 2025, 03:03:41 pm
content: May or may not be related - as of a few days ago, I stopped getting images in search results - affects Cherome & Firefox under Win7 ( tested 2 on PCs) , OK on Firefox/Win10 and AndroidHave reported to them, no response so farAnyone else seen this ?

author: SiliconWizard
author_rank: Super Contributor
timestamp: September 12, 2025, 03:29:25 pm
content: So, today things seem to be fixed. They also seem to have updated the website, it has some slight changes.As to images missing, I also got that occasionally. I'm guessing it might be due to using adblockers (which likely block some images) but haven't looked into it.

author: Cyclotron
author_rank: Unknown
timestamp: September 12, 2025, 04:49:20 pm
content: QuoteOh I have no doubt there's a lot of weirdos using VPN for weirdo reasons. Given the sales push in Youtube and social media videos, I wonder how many people use it with their advertised intent.QuoteCompanies have over the years had to use LTS browsers because internal systems are so far outdated that they don't work well with modern browsers.The typical answer to why they use LTS, is compatibility with their systems, stability, and security.There's readily available code/libraries for bots to use to farm out captcha to human farms. Large numbers of people making a bit of side cash to solve a puzzle.I just got my digikey order for the weekend in. Yay, time to solder.

author: David Hess
author_rank: Super Contributor
timestamp: September 12, 2025, 05:00:05 pm
content: I tried Digi-key through a couple of endpoints of the VPN service I use and did not have any problems, but this does not mean much.

author: Cyclotron
author_rank: Unknown
timestamp: September 12, 2025, 05:22:55 pm
content: The bad actors are always evolving and sometimes they come up with some pretty interesting "tricks".If you happen to find yourself with a page that asks you to validate you're human and asks you to inputWin + R -> CTRL + V -> Enter, don't!

author: tooki
author_rank: Super Contributor
timestamp: September 12, 2025, 10:49:38 pm
content: Quote from: SiliconWizard on September 11, 2025, 02:23:57 pmIt’s not just you. It’s infuriating. At least for me, it’s just at work (a university LAN), regardless of device (I reproduced it on my Windows PC and my iPad). The one causing issues for me is Cloudflare, not PerimeterX.I wrote them a message about it.For those who don’t know, the issue that mikeselectricstuff and I are experiencing is that all their images and documents (like PDFs) are hosted on the hostnamemm.digikey.com, and that server’s Cloudflare is suddenly being super touchy. Now, with a PDF, you’re just getting the “click box to prove you’re human” silliness, but the problem is that images simply break and don’t appear. Well, not until you then click a PDF link, or try to open an image in a new tab, to force the “prove you’re human” test to appear. And then you’re good for about a half hour…

author: tooki
author_rank: Super Contributor
timestamp: September 12, 2025, 10:58:22 pm
content: Quote from: mikeselectricstuff on September 12, 2025, 03:03:41 pmYep, that’s precisely what I ran into yesterday. I also have not yet received a response to my report.At least there’s a workaround, see above.

author: bte
author_rank: Regular Contributor
timestamp: September 12, 2025, 11:26:22 pm
content: Quote from: tooki on September 12, 2025, 10:58:22 pmWith older browsers, there are issues with the parsing, probably indicating new syntax that the old browser doesn't know about. See the attachments for screenshots from Firefox90, Chrome108 and Supermium 126, all running on Windows 7. I didn't try to find out what was added to Chrome after build 108 so that the site works OK with Supermium (Supermium is Chrome, modified to run on older OS like Windows 7).https://github.com/win32ss/supermium

author: tooki
author_rank: Super Contributor
timestamp: September 12, 2025, 11:29:36 pm
content: Quote from: bte on September 12, 2025, 11:26:22 pmNeither my Windows work computer nor my personal iPad are running old browsers. On Windows I was using a fully-updated Firefox, on the iPad, a recent (but not entirely newest) Safari.Also, the problem only showed up at work, which gets a lot more captchas (across all websites) than I get at home.

author: bte
author_rank: Regular Contributor
timestamp: September 13, 2025, 12:03:29 am
content: Quote from: tooki on September 12, 2025, 11:29:36 pmApologies. I should have quoted the post from mikeselectricstuff. He was the one to report a difference of OS/browser he tested with.You could still check the browser console to see if there are any errors.

author: bte
author_rank: Regular Contributor
timestamp: September 13, 2025, 12:19:56 am
content: Quote from: bte on September 13, 2025, 12:03:29 amI looked more into this. Yes, it wasn't about the syntax error, the error is there on Supermium browser as well and yes, it looks like a simple syntax error rather than a new syntax for a new feature.The URL for that image doesn't load on Firefox 90 because the site rejects my browser as old (even though the main page works fine and allows me to do search). It didn't load on Chrome 108 because of captcha. Once solved, the image showed up OK on Chrome 108 as well. So yes, it looks like it was a captcha problem all along. I apologize for the unnecessary distraction.

author: Cyclotron
author_rank: Unknown
timestamp: September 13, 2025, 07:22:17 pm
content: I just got hit by the missing images issue while looking for some connectors on one of my MAC computers. The images capture from Brave and one from Safari doing the same thing. A windows computer here sourcing from my network with the same IP had no issues with Firefox or Edge.On my computer with the lack of images I pulled the URI of the images missing and requested them with out caching, they were blocked initially by Cloudflare. Then it allowed them.For me this provides direct proof that DigiKey's issues are related to their use of Cloudflare. At least as far as the data/evidence I can evaluate for the missing images problem. The return code is 403 Forbidden. This also supports that the issue is with Cloudflare.All my experience with Clouflare indicates they have a mostly crappy product for WAF. Unfortunately, this issue seems to add to that view.

author: Cyclotron
author_rank: Unknown
timestamp: September 13, 2025, 07:35:07 pm
content: In a browser that is currently lacking images, I grabbed the image URL and did a request for just it and I get the Cloudflare "human" check.

author: tooki
author_rank: Super Contributor
timestamp: September 13, 2025, 07:50:27 pm
content: Yep, that’s precisely the issue I encountered the other day. Someone diddled with their Cloudflare settings and messed it up.

author: tooki
author_rank: Super Contributor
timestamp: September 13, 2025, 08:03:42 pm
content: Also, everyone affected who hasn’t done so, be sure to file a report with Digikey:https://www.digikey.com/en/help-support/fraud-and-security/website-issue-tips

author: Faranight
author_rank: Unknown
timestamp: September 14, 2025, 03:21:29 am
content: Quote from: ataradov on September 11, 2025, 04:29:27 pmI'm also having major problem with Mouser. Their website has become mostly unusable. Every time during a search I get interrupted with a white page telling me to enable javascript and disable ad blocker. Funny thing, if you reload the page, it will actually show the results at least most of the time. But sometimes I get blocked completely and cannot use the site at all. Is there anywhere we can file a complaint with Mouser about this? I mean, can they at least disable this for logged-in accounts?Meh, I'll see, if I can order from TME instead.

author: pope
author_rank: Frequent Contributor
timestamp: September 17, 2025, 01:49:37 pm
content: Is the Digikey image issue sorted or it's my impression?

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: September 17, 2025, 04:35:22 pm
content: Quote from: pope on September 17, 2025, 01:49:37 pmWorking OK for me now