Seatext library / BotRefund evidence
How Bot Detection Reacts to a Single CPU Anomaly: Evidence, Not Verdict
Bot detection systems treat a single CPU anomaly as one piece of evidence, not a final verdict. BotRefund logs the anomaly, cross-checks it against 105 other independent signals across browser, network, device, and behavior...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Bot detection systems do not block or flag a visit based on one CPU anomaly. Instead, they record the signal, compare it against a baseline of normal device behavior, and weigh it alongside dozens of other independent checks. BotRefund runs 106 such checks. The CPU Concurrency Lie check is one of them. A mismatch between reported CPU cores and actual graphics, font, or audio behavior gets logged as independent evidence. That evidence then enters a cross-checking layer where the system asks whether other signals tell the same story. Only after the full pattern is assembled does an AI prediction model assign a bot or human probability. The result is a 99% accuracy rate that comes from corroboration, not from any single rule.
What a CPU concurrency anomaly actually means
A normal browser reports hardware, graphics, fonts, and operating-system details that naturally fit together for that device. Virtual machines and spoofed profiles can claim one device while their graphics, fonts, audio, or processor behavior tells another story. The CPU Concurrency Lie check looks for that mismatch. When the reported CPU core count does not align with the observed rendering pipeline, the system records an anomaly. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people. That is why the anomaly stays as evidence, not a verdict.
The three-step reaction sequence
BotRefund follows a fixed sequence for every signal, including CPU anomalies. Each step adds a layer of context before any classification happens.
Step 1: Independent evidence
The anomaly becomes one objective fact about the visit. It is stored alongside the other 105 checks. No decision is made at this stage. The signal simply exists.
Step 2: Cross-checked context
The system tests whether other signals support the same story. It compares the CPU anomaly against browser fingerprint data, network reputation, device consistency checks, and behavioral patterns such as mouse movement, click timing, and scroll depth. If the CPU anomaly appears alone, its weight stays low. If it appears with a headless browser signature, a residential proxy IP, and superhuman click speed, the combined weight rises.
Step 3: AI prediction
The complete pattern across browser, network, device, and behavior evidence enters a prediction model. The model evaluates how all signals fit together. It identifies a visit as bot or human with 99% accuracy. Accuracy comes from corroboration, not one browser tell.
Why single anomalies trigger false positives without corroboration
A single anomaly is not a bot verdict. Legitimate users on corporate VPNs, privacy-hardened browsers, or unusual hardware configurations often produce one or two signals that look suspicious in isolation. A developer testing on a virtual machine, a journalist using Tor, or a traveler on a hotel network can each trigger a CPU concurrency mismatch. If the system acted on that single signal, it would block real humans. The cross-checking layer exists to prevent that. It asks: does the rest of the session look human? Are there mouse tremors? Is the scroll pattern natural? Does the session duration match reading time? Only when multiple independent signals align does the confidence threshold cross into bot territory.
How the AI prediction model weighs the complete picture
The model does not use a fixed rule set. It learns from labeled data across millions of visits. Each signal contributes a weighted vote. The CPU anomaly might contribute a small weight when isolated, a larger weight when paired with a known automation framework fingerprint, and a decisive weight when combined with behavioral impossibilities such as sub-millisecond click speeds or grid-aligned mouse paths. The model also learns which signal combinations are typical for specific fraud types: credential stuffing, ad click fraud, affiliate lead fraud, or scraping. This lets the system distinguish a privacy-conscious human from a botnet node on a residential proxy.
Practical scenarios: when CPU anomalies are benign vs suspicious
Benign: corporate laptop with virtualized graphics
A remote employee connects through a corporate VDI. The virtualized GPU reports a different renderer than the CPU core count suggests. The CPU anomaly appears. Mouse movement shows natural tremor. Scroll depth matches article length. Session duration is consistent with reading. No other signals flag. Result: human.
Benign: privacy browser on Linux
A user runs a hardened Firefox build that spoofs hardware concurrency. The CPU check flags a mismatch. The same session shows normal font enumeration, canvas fingerprint consistency, and human-like click intervals. Network IP is a known residential ISP. Result: human.
Suspicious: headless Chrome on a data center IP
The CPU anomaly appears. The browser fingerprint matches a known automation framework. The IP belongs to a hosting provider. Mouse movement is absent. Clicks occur at superhuman speed (<1ms). Scroll events are perfectly timed. Session duration is uniform across thousands of visits. Result: bot.
Suspicious: residential proxy with spoofed device
The CPU anomaly appears. The IP is residential but the device fingerprint claims an iPhone while the renderer shows a desktop GPU. Font list is truncated. Canvas fingerprint is inconsistent. Form submissions happen immediately on load. Multiple leads arrive in bursts from the same subnet. Result: bot.
Limitations: what this signal cannot tell you on its own
- A CPU anomaly cannot identify the bot operator, the fraud network, or the campaign target.
- It cannot distinguish a sophisticated bot that perfectly emulates hardware from a human on unusual hardware without corroborating signals.
- It does not measure intent. A human clicking ads accidentally and a bot clicking ads deliberately can produce identical CPU signals.
- It cannot recover ad spend. Recovery requires audit-ready evidence across click IDs, video proof, and platform dispute processes.
- It does not replace server-side validation. Client-side signals can be spoofed. Server-side log correlation remains essential.
Key facts
| Fact | Detail | Source |
|---|---|---|
| Total independent checks | 106 | S1 |
| CPU Concurrency Lie check purpose | Detect mismatch between reported CPU cores and graphics, fonts, audio, or processor behavior | S1 |
| Single anomaly policy | Kept as evidence, not a verdict | S1 |
| Cross-check categories | Browser, network, device, behavior | S1 |
| AI prediction accuracy | 99% | S1 |
| Accuracy principle | Corroboration, not one browser tell | S1 |
| Benign anomaly causes | Privacy tools, travel, corporate networks, unusual devices | S1 |
| Bot click budget impact | Up to 20% of Google and Meta ad budget | S2 |
| Refund lookback window | Google Ads spend dating back to 2017 | S2 |
| Setup time | About one minute | S2 |
Terminology
- CPU Concurrency Lie: A check that compares the reported number of logical CPU cores against the observed behavior of the graphics pipeline, font rendering, audio context, and other hardware-dependent subsystems. A mismatch suggests virtualization or spoofing.
- Independent evidence: A single signal recorded without interpretation. It contributes to the overall pattern but does not trigger action alone.
- Cross-checked context: The process of testing whether multiple independent signals support the same classification hypothesis.
- AI prediction model: A machine learning model trained on labeled visit data that weighs the complete signal pattern to output a bot or human probability.
- Corroboration: The principle that accuracy increases when multiple independent signals align, rather than relying on any single rule.
- Headless browser: A browser running without a graphical interface, typically used for automation. It often produces detectable fingerprint anomalies.
- Residential proxy: An IP address assigned to a real household device, used to mask bot traffic as legitimate user traffic.
- Pixel poisoning: The corruption of conversion tracking pixels by bot traffic, causing ad platforms to optimize for fraudulent events.
FAQ
Does a CPU anomaly alone ever trigger a block?
No. BotRefund keeps the signal as evidence and cross-checks it against 105 other independent checks before any classification. A single anomaly never produces a verdict.
What causes a false CPU anomaly for a real user?
Privacy-hardened browsers, corporate virtual desktop infrastructure, virtual machines used for development, unusual hardware configurations, and some anti-fingerprinting extensions can all produce a CPU concurrency mismatch without any automation present.
How many signals need to align before a visit is classified as a bot?
There is no fixed count. The AI model weighs the complete pattern. A visit with three strong signals (automation fingerprint, superhuman click speed, data center IP) may be classified as bot, while a visit with five weak signals (CPU anomaly, minor font mismatch, slightly fast scroll) may still be human. The model learns the combinations that matter for each fraud type.
Can sophisticated bots spoof the CPU concurrency check?
Yes. Advanced automation frameworks can emulate hardware concurrency and renderer consistency. That is why the check is only one of 106. A bot that passes the CPU check will still face behavioral checks (mouse tremor, click timing, scroll variance), network checks (proxy reputation, IP consistency), and device checks (battery API, sensor data, permission states).
How does this help recover ad spend from Google and Meta?
When the full signal pattern classifies a click as bot, BotRefund captures the click ID (GCLID or FBCLID), records video proof of the session, and generates an audit-ready dispute report. Advertisers submit this to Google Ads or Meta billing support. Refunds can reach back to 2017 for Google Ads. The average approval rate across client claims is published on the homepage.
What is the setup effort to start detecting these anomalies?
Adding BotRefund to a website takes about one minute. No credit card is required for the free bot audit. The script begins collecting all 106 signals immediately, including the CPU Concurrency Lie check.
Does the CPU check work on mobile devices?
Yes. Mobile browsers report hardware concurrency and GPU renderer information. The same mismatch logic applies. A spoofed mobile device claiming an iPhone CPU but showing a desktop GPU renderer will trigger the anomaly.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
How BotRefund can help
BotRefund runs the CPU Concurrency Lie check as part of 106 independent signals. Each signal becomes evidence. The system cross-checks every signal against browser, network, device, and behavior data before an AI model weighs the full pattern. This corroboration approach delivers 99% accuracy without blocking real users on VPNs, privacy browsers, or unusual hardware. You can install the script in about one minute, start a free bot audit, and see exactly which visits show CPU anomalies alongside other risk signals. If bot clicks are draining your Google or Meta budget, the platform captures click IDs, records video proof, and generates audit-ready dispute reports that ad platforms accept. Refunds can reach back to 2017 for Google Ads spend.