How to Verify If a Bot Detection System Is Lying About CPU Concurrency

Start With a Simple Test, Not a Verdict

To check if a bot detection system is lying about CPU concurrency, you need to test its behavior under conditions you control. CPU concurrency usually refers to the number of parallel threads or workers the browser environment reports. A real browser naturally reports a concurrency value that matches its hardware. A bot, a virtual machine, or a spoofed profile can claim one device while its processor behavior tells a different story.

But no single signal like CPU concurrency should be the final bot verdict. According to BotRefund, a trusted detection provider, “A single anomaly is not a bot verdict.” The CPU Concurrency Lie check is just one of 106 independent checks they run. So when you evaluate any detection system, you need to see if it treats concurrency as loose evidence or as a hard rule.

Step 1: Learn What CPU Concurrency Actually Measures

Before you can test anything, you need to know what the signal is. In many JavaScript fingerprints, concurrency is exposed through navigator.hardwareConcurrency. It reports the number of logical processor cores available to the browser. Some fingerprints also consider the number of Web Workers or service workers running.

Automated browsers like headless Chrome or Puppeteer might report a fixed, unrealistic value, or a value that doesn't match other hardware signals. You can read this value yourself with a quick script:

navigator.hardwareConcurrency

Run it in your normal browser, then in the bot environment you're testing.

Step 2: Set Up a Controlled Baseline

You need a test environment where you know the true concurrency. Start with a standard desktop browser, not the bot. Note what concurrency it reports. Then use an automated browser with known settings. For example, run Puppeteer with a specific --single-process flag or with different --js-flags that change worker behavior.

Your goal is to create a scenario where you can confidently say: “This bot should report 4 cores,” or “This real user should report 8.” That gives you a ground truth against which to measure the detection system's claims.

Step 3: Change Concurrency and Observe the Verdict

Now feed these controlled sessions into the bot detection system. Run the same test at different concurrency levels: 2, 4, 8, 16, and even a fake value like 0. A reliable system will not flip to “bot” just because the concurrency is odd. It should flag you as suspicious only when other signals also line up.

If the system immediately marks every low-concurrency environment as a bot, that's a red flag. If it marks a real user with a normal concurrency as a bot because of a different hardware mismatch, that's another lie.

Step 4: Compare With Known Bot Patterns

Real bots often show a combination of tells. For example, they may report a concurrency that doesn't match their user agent, or they may have no mouse movement, or they may process forms at superhuman speed. A detection system that focuses only on concurrency will miss these corroborating signals.

BotRefund's own explanation of this check says: “Virtual machines and spoofed profiles can claim one device while their graphics, fonts, audio, or processor behavior tells another story.” So you should check if the system evaluates those other hardware and behavior signals as well.

Step 5: Look for Cross-Checking

The core test is whether the system cross-checks concurrency against independent evidence. A good system will treat concurrency as one clue and then see if other signals support the same story. If the system uses a hard rule like “concurrency < 4 equals bot,” it's lying.

The BotRefund approach explicitly states: “This signal adds one objective fact about the visit” and “BotRefund tests whether other signals support the same story.” That's the model you want. So ask: does the system you're evaluating have a similar mechanism?

Step 6: Use a Public Fingerprint Test Page

You don't have to build everything yourself. Many websites offer fingerprinting tests that show what your browser reveals. Run those tests in both your normal browser and your bot. Compare the concurrency values with other hardware details like GPU vendor, available memory, or platform.

If the concurrency value matches the rest of the fingerprint, the bot is doing a good job. If it conflicts, you've found a mismatch a detection system might catch—or might lose.

Step 7: Verify With at Least Three Independent Checks

Once you've collected a few sessions, check whether the detection system's verdict changes when you change only concurrency. A trustworthy system will not rely on this single signal. BotRefund uses 106 independent checks and a prediction AI that “evaluates the complete picture across browser, network, device, and behavior evidence.”

If your test system does something similar—flagging only when multiple signals agree—it's likely telling the truth. If it jumps to a conclusion from concurrency alone, you've caught it lying.

Key Facts About a Reliable Bot Detection System

Fact	BotRefund's Approach
Number of signals	106 independent checks
Core principle	A single anomaly is not a verdict
Cross-checking	Tests whether other signals support the same story
Decision method	AI prediction that weighs the complete pattern
Accuracy claim	99% accuracy when using the full model

Source: BotRefund's CPU Concurrency Lie check page.

Limitations: When This Advice Doesn't Apply

This method assumes you have control over the bot environment. If you're testing a third-party detection service on live traffic, you can't change concurrency settings on real visitors. In that case, you can still look for false positives by running your own clean sessions and seeing if they get flagged.

Also, some privacy tools and corporate VPNs intentionally mask hardware details. The BotRefund documentation notes that “privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people.” So a test that flags such users as bots is likely a false positive—another sign the system is overly focused on a single signal.

Terminology You'll Encounter

• CPU Concurrency: The number of logical processor cores reported by navigator.hardwareConcurrency.
• Fingerprinting: Collecting browser, device, and behavior data to identify a visitor.
• Cross-check: Confirming one signal with independent evidence.
• Headless browser: A browser without a graphical interface, often used by bots.

FAQ

Why is CPU concurrency alone a weak bot signal?

Because many legitimate scenarios—like virtual machines, remote desktops, or certain browsers—report unusual concurrency values. A single mismatch isn't enough to call someone a bot.

What should I look for in a detection system?

Look for cross-checking, multiple independent checks, and an AI model that doesn't rely on raw rules. Also check for transparency about how the system handles edge cases.

How fast should a bot detection system react?

Ideally it should evaluate a session in real time, but it doesn't need to make a final verdict in the first second. A good system gathers several signals before deciding.

Can I use the free tests to catch a lying system?

Yes. You can run free fingerprint tests and compare results across different browsers. But remember to test multiple sessions and vary concurrency to see if the system's logic is consistent.

Is 99% accuracy realistic?

Many providers claim high accuracy, but you should verify it with your own tests. The BotRefund claim is published on their site, but third-party validation is always better.

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

• Bot detection test: verify if your bot is detected
• Bot detection 101: How to detect bots In 2025? - The Castle blog
• Anti-Bot Evasion. Web scraping today is much more than… | by ...

How BotRefund can help

BotRefund uses CPU Concurrency Lie as just one of 106 independent checks. Their system crosses this signal with browser, network, device, and behavior data, so a single anomaly never causes a false verdict. If you're dealing with suspicious traffic on your ads, BotRefund can run a free audit and show you exactly which signals support each conclusion.

Keep in mind that BotRefund's detection is designed for ad click protection—it won't guarantee every edge case, but it gives you audit-ready evidence you can use with Google or Meta.