CPU Concurrency Detection vs Browser Fingerprinting: Which Catches Bots Better?

CPU concurrency detection and browser fingerprinting both help you spot bots, but they take different paths. CPU concurrency detection looks at how a browser reports the number of logical processors it can use, then checks whether that story matches other device and behavior signals. Browser fingerprinting collects dozens of attributes—screen size, fonts, GPU, timezone, plugins—and builds a unique identifier for each visitor. The direct answer: CPU concurrency detection is harder to spoof because it relies on a live runtime check, while browser fingerprinting gives you more data but is easier to fake with popular tools. The smartest approach is to use both.

What Is CPU Concurrency Detection?

CPU concurrency detection uses the navigator.hardwareConcurrency API, which tells a website how many logical processor cores the browser can use. Real browsers report a number that matches the physical device—for example, 8 or 16. Automated browsers, especially those running in virtual machines or with spoofed profiles, often claim a different number than what the underlying hardware supports. The check looks for that mismatch, plus whether the reported concurrency stays consistent across the session.

BotRefund calls this the “CPU Concurrency Lie” check and uses it as one of its 106 independent signals. A normal user’s browser reports hardware, graphics, fonts, and operating-system details that naturally fit together for that device. When a bot claims one device but its graphics, fonts, audio, or processor behavior tells another story, the concurrency check flags the inconsistency.

What Is Browser Fingerprinting?

Browser fingerprinting is a broader technique. It collects a wide set of attributes from the visitor’s browser: user agent, screen resolution, installed fonts, GPU details, timezone, language, touch support, and more. These attributes are combined into a hash that acts like a unique ID. Because most people have a rare combination, the fingerprint can track users across sessions and even across different browsers on the same device.

This data richness makes fingerprinting powerful for recognizing repeat visitors and spotting fraud rings that use the same device. However, it is also easier to spoof. Many anti-detect browsers and privacy tools randomize or mask these attributes, which can create false positives or give attackers control over their visible fingerprint.

How They Compare on Key Factors

The table above shows the core trade-offs. CPU concurrency detection is a single, dynamic value that is hard to fake accurately. Browser fingerprinting is a composite that gives you more dimension but each piece can be individually forged. In practice, a determined bot can spoof either, but spoofing CPU concurrency correctly requires knowing the real hardware profile of the machine running the bot, which is rarely available.

Think of it this way: CPU concurrency detection is like checking a person’s heart rate—hard to fake convincingly. Browser fingerprinting is like taking a full photo ID—rich but photocopyable.

Who Should Use Which Approach?

Choose CPU concurrency detection if you want a fast, hard-to-spoof check for high-value actions like form submissions, account signups, or checkout. It adds a small script and can be combined with other behavior signals to catch bots that fake browser profiles.

Choose browser fingerprinting if you need to recognize returning users, correlate sessions, or build a long-term ID for fraud investigation. It works well when you control the full attribute set and can tolerate occasional false matches.

Choose both if you run paid ad campaigns or have a high risk of ad fraud. The combination gives you more evidence and fewer false positives because each signal independently corroborates or contradicts the other.

Why Combining Techniques Improves Accuracy

No single check is a bot verdict. BotRefund’s approach illustrates this: it treats CPU concurrency as one objective fact about the visit, then tests whether other signals support the same story. Its AI model weighs the complete pattern across browser, network, device, and behavior evidence. That corroboration is why the system claims 99% accuracy. A lone concurrency mismatch might be a privacy tool or a corporate network; when it matches other anomalies, the evidence becomes strong.

In practical terms, combining techniques lets you catch bots that pass a static fingerprint but fail a dynamic check, and vice versa. It also reduces false positives for legitimate users who use VPNs or unusual devices.

Limitations and When They Don't Apply

Both techniques have weaknesses. CPU concurrency detection can be fooled if the attacker knows the exact hardware of their proxy machine. Browser fingerprinting can be blocked by browser privacy features like fingerprinting protection, which returns randomized values to all sites. Also, enterprise networks that route traffic through shared gateways may show consistent concurrency numbers for many users, making fingerprinting less unique.

For genuine users who use privacy extensions, travel, or have very new or old hardware, a concurrency mismatch alone is not a reliable reason to block them. BotRefund acknowledges this by keeping the signal as evidence, not a verdict, and cross-checking it against independent data.

Key Facts About BotRefund's Detection Approach

These facts come directly from BotRefund’s published documentation. The company also reports that bot clicks can steal up to 20% of Google and Meta ad budget, which is why their detection is built for refund-ready evidence.

FAQ

Can CPU concurrency detection be bypassed?

Yes, but it’s harder than spoofing a static fingerprint. An attacker would need to know the exact logical core count of the machine running the bot and make sure it stays consistent while other hardware signals also match.

Does browser fingerprinting work on all browsers?

Most modern browsers expose the necessary APIs, but privacy browsers like Brave or Tor often block or randomize them. That can reduce the uniqueness and reliability of the fingerprint.

What is navigator.hardwareConcurrency?

It’s a JavaScript API that returns the number of logical processor cores available to the browser. It’s part of the Web Platform APIs and is supported in all major browsers.

How do these techniques handle privacy tools?

They don’t handle them perfectly. A privacy tool might change the reported concurrency or other fingerprint attributes, causing false positives. That’s why a single anomaly should never be a bot verdict.

Which technique is best for stopping ad fraud?

Neither alone is enough. Combining CPU concurrency detection with browser fingerprinting, behavior analysis, and AI-driven pattern recognition gives the strongest protection. BotRefund uses this multi-layered approach to recover ad spend and prove invalid clicks.