Seatext library / BotRefund evidence
CPU Concurrency and Bot Detection: How Browser Signals Expose Automation
CPU concurrency is a browser signal that reveals the number of logical processors on a device. Bots often report unrealistic concurrency values or hardware profiles that don't match reality. BotRefund uses this signal as...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
CPU concurrency is a browser signal that reveals the number of logical processors a device reports. In bot detection, it becomes a red flag when the value or the hardware profile it implies doesn't fit the rest of the visit. Automated browsers often claim concurrency numbers that are either unrealistic or inconsistent with other details like graphics, fonts, or operating system. BotRefund treats CPU concurrency as one of 106 independent checks, using it as evidence—not a verdict—to identify bot visits.
What is CPU concurrency in a browser?
Modern browsers expose the number of logical processors through the navigator.hardwareConcurrency API. This value tells websites how many CPU cores the device can run in parallel. It's part of a broader set of hardware fingerprints that includes GPU, memory, and display info. A real browser on a typical laptop may report between 4 and 16. A high-end desktop might report 32 or more. A smartphone usually reports 8 or fewer.
Logical processors differ from physical cores. Thanks to hyper-threading, a quad-core CPU often shows 8 threads. The browser sees these threads as available parallelism. This is why a value of 8 on many laptops is normal, while a value of 64 on a phone is impossible. Bots, especially those running in virtual machines or headless browsers, often report numbers that look odd.
Hardware concurrency is a fingerprinting signal because it is relatively stable for a given device. A real user's concurrency value rarely changes across sessions. Bots that spoof this value often hardcode it or randomize it in ways that break that stability. For example, a script might claim 8 cores for every visit, even when the actual device is a server with 128 cores. Or it might switch between 4 and 16 on the same session, which no physical device can do.
How the CPU Concurrency Lie check works
BotRefund's CPU Concurrency Lie check looks for a mismatch between the claimed device and other hardware or behavior signals. A normal user's browser reports hardware, graphics, fonts, and operating-system details that naturally fit together. Automated browsers often fail this test. For example, a script might spoof a high-end laptop profile but reveal a GPU or font set that doesn't belong to that device.
One common mismatch is a high concurrency value paired with a low-end GPU. A real 32-core workstation usually has a discrete graphics card. A bot might claim 32 cores while reporting integrated graphics from a 2012 laptop. Another mismatch is concurrency with the operating system. A phone that reports 16 cores is impossible, as most mobile chips have 8 or fewer. Bots also fail when they report a value that contradicts other signals like memory or screen resolution.
The check does not stop at static values. It also looks at how concurrency is reported over time. A real user's value is consistent. If a bot varies the value across page loads, that is a strong sign of automation. Even more telling is when a bot reports the exact same value for every visit, because real users on the same device will eventually have a different value if they change devices. This consistency or inconsistency is part of the lie check.
Why a single anomaly is not a bot verdict (expert perspective)
BotRefund's own documentation is explicit: "A single anomaly is not a bot verdict." That's the expert perspective that separates effective detection from naive rules. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people. A security-conscious user might block WebGL, use a VPN, or run a virtual machine for work. Their concurrency value may not match the rest of their profile, but they're still human.
Consider a user on a cloud desktop. They might access a website from a remote virtual machine that reports 64 cores, but the GPU is a basic virtual adapter. That combination is unusual but possible for a legitimate remote worker. A privacy browser like Tor can randomize hardware values, including concurrency. A person using such a tool could trigger a mismatch without any malicious intent.
Because of these legitimate scenarios, a single mismatch is never enough. BotRefund stores it as one of 106 independent bits of evidence. The system then cross-checks it against browser, network, device, and behavior data. Only when multiple signals corroborate does the system lean toward a bot classification. This corroboration is what makes the detection accurate, not any single tell.
How BotRefund cross-checks CPU concurrency with other signals
BotRefund uses a prediction AI that weighs the complete pattern instead of trusting a raw rule. The CPU concurrency signal adds one objective fact about the visit. Then the system asks: do the other signals support the same story? If the concurrency number is unrealistic, but the user's mouse movements are human-like, the visit may still be human. If the concurrency is off and the click speed is superhuman, that's a stronger bot signal.
BotRefund evaluates concurrency alongside GPU fingerprinting, font enumeration, audio context fingerprints, and WebGL renderer details. It also considers network data like IP address, TLS fingerprint, and request timing. Behavioral signals include mouse movement, scrolling, and keystroke dynamics. Each signal is independent, so a bot that fakes one rarely fakes them all.
The AI model assigns weights to each signal based on how often they predict bots in real-world traffic. Concurrency may be a stronger signal for headless browsers, while behavior is stronger for human-like bots. By combining many weak signals, BotRefund achieves high accuracy. According to the source, this corroboration is why BotRefund reports 99% accuracy.
Key facts about CPU concurrency detection
| Signal | What it checks | Why it matters |
|---|---|---|
| Hardware concurrency | Number of logical processors reported by the browser | Reveals if the claimed device is physically plausible |
| Profile consistency | Matches concurrency with GPU, memory, OS, and fonts | Bots often mix specs from different devices |
| Stability over time | Checks if the value changes across visits | Real devices have a constant concurrency; bots may vary or hardcode |
| Cross-checking | Verifies concurrency against network, behavior, and device data | Provides high confidence through corroboration |
| Single anomaly vs. verdict | Treats one mismatch as evidence, not a conclusion | Reduces false positives for legitimate users |
This table is based on BotRefund's published methodology for the CPU concurrency lie check.
Limitations and false positives to consider
CPU concurrency detection has real limitations. A user behind a corporate VPN or using a remote desktop may have a concurrency value that reflects the server, not their local device. Privacy browsers might randomize hardware values. Even legitimate VM users on cloud desktops can trigger odd numbers.
Remote desktop software often reports the host machine's concurrency, not the client. A worker connecting to a high-core server from a thin client could show 32 cores while the local device has only 4. That mismatch is real, and a naive rule would falsely flag them.
Privacy tools like Tor Browser or Brave with fingerprinting protection can alter the reported concurrency. Some extensions spoof hardware values to reduce tracking. A user who installs such an extension might see their concurrency value change randomly. That is not a sign of automation, but it could look like one.
If a site blocks or flags every visitor with an unusual concurrency value, it will hurt real users. The advice from BotRefund is to treat concurrency as evidence, not a verdict. It should be used alongside many other signals. In practice, that means a single mismatch shouldn't trigger a block. It should only increase suspicion when other indicators agree.
Practical steps to protect your site from concurrency-based bot tricks
- Collect concurrency data on every page load. Record the reported value, user agent, and device memory. Also store the timestamp and a session ID.
- Compare concurrency with other hardware signals like GPU, screen size, and OS. Check if they fit a real device profile. For example, a low-end GPU with 64 cores is suspicious.
- Look for patterns over time. A static concurrency value across millions of visits is suspicious. Variation is human. Track how often the value changes for a given session or IP.
- Use concurrency as one input in a scoring model. Never block based on this single value alone. Combine it with behavioral signals like mouse movement, key press speed, and navigation patterns.
- Monitor false positives. Check the share of flagged visitors who still convert or engage. If many flagged users complete purchases, your thresholds are too strict. Adjust them.
- Test with real users. Use your own team and privacy tools to see what values appear. Build a small dataset of legitimate concurrency ranges for your audience.
If you don't have the engineering time to build this yourself, use a service like BotRefund. It runs 106 checks and cross-references them automatically. You can get started in about one minute.
Frequently asked questions
Is CPU concurrency the same as CPU cores?
No. Concurrency refers to logical processors, which often double the physical core count through hyper-threading. A quad-core CPU may show 8 concurrency.
Can a bot spoof a realistic concurrency value?
Yes. Some advanced automation tools can set the value. But that's why the check looks for consistency with other hardware and behavior signals, not just the number itself.
Why would a real user have an unusual concurrency value?
Virtual machines, remote desktops, and privacy tools can cause mismatches. Corporate networks and browser extensions may also alter reported values.
Does BotRefund block visitors based on this signal alone?
No. BotRefund explicitly says a single anomaly is not a bot verdict. It uses concurrency as one of 106 independent checks and cross-references the full picture.
How accurate is CPU concurrency detection?
On its own, it's not reliable. But as part of a multi-signal model with corroboration, BotRefund reports 99% accuracy. The strength comes from combining many weak signals.
What should I do if I see many visitors with the same concurrency value?
That could be a sign of bot traffic, especially if other signals like behavior or network patterns also look automated. Run a full audit to investigate.
Can CPU concurrency change for a real device?
Rarely. A physical device's concurrency is fixed unless the OS is changed. If you see values flipping between numbers, it often indicates a spoofing script.
How does BotRefund use concurrency in AI prediction?
BotRefund sends concurrency as one of 106 features into its prediction AI. The model weighs it against all other signals to decide if the visit is human or automated.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.