What Is the CPU Concurrency Lie and How Does It Relate to Bot Detection?

The CPU concurrency lie is a fingerprinting inconsistency where a browser's reported hardware concurrency (the number of logical CPU cores) conflicts with other observable hardware and behavioral signals. BotRefund detects this mismatch as one of 106 independent checks, using it as corroborating evidence — not a standalone verdict — to help identify automated traffic with 99% accuracy when combined with browser, network, device, and behavior data.

What the CPU Concurrency Lie Actually Is

Modern browsers expose a navigator.hardwareConcurrency property that tells websites how many logical CPU cores the device has. Legitimate browsers on real hardware report values that align with the device's actual processor — for example, 4, 8, or 16 cores on common laptops and phones. The "lie" appears when this reported number doesn't match what the browser's graphics rendering, font enumeration, audio stack, or timing behavior suggests about the underlying hardware.

BotRefund's documentation describes it as a mismatch "that a real browsing session does not normally create." Virtual machines, headless browsers, and spoofed fingerprinting profiles often claim a standard desktop core count while their GPU fingerprint, canvas rendering, or JavaScript execution timing reveals a different hardware reality.

How Browsers Report CPU Cores

The hardwareConcurrency API was standardized to help web applications optimize thread usage for tasks like video encoding, physics simulations, or parallel data processing. A genuine Chrome on Windows 11 with an Intel i7-12700H might report 14 logical cores. Safari on an M2 MacBook Air reports 8. These values are derived from the operating system's processor enumeration.

Because the API is read-only and provided by the browser engine, it's difficult for a script running inside the page to modify it directly. However, automation frameworks that control the browser from outside — such as Puppeteer, Playwright, or Selenium — can launch browser instances with overridden flags or run inside virtualized environments where the reported core count is configurable or simply wrong for the claimed device profile.

Why Automated Browsers Get It Wrong

Attackers building bot networks face a consistency problem. They want each bot to look like a unique, realistic device. But the hardware signals a browser emits — CPU cores, GPU renderer, screen resolution, battery status, audio context fingerprint, font list, and dozens of timing behaviors — are mathematically correlated on real hardware. A device with 2 CPU cores almost never has a high-end discrete GPU. A phone reporting 8 cores won't have a desktop-class canvas fingerprint.

Spoofing one value (like hardwareConcurrency) without perfectly aligning the other 100+ correlated signals creates detectable anomalies. BotRefund's source material notes that "virtual machines and spoofed profiles can claim one device while their graphics, fonts, audio, or processor behavior tells another story." The CPU concurrency lie is essentially a consistency check across the hardware fingerprint.

How BotRefund Uses This Signal

BotRefund does not block or flag a visitor based on the CPU concurrency lie alone. Instead, it follows a three-step process documented in their detection methodology:

1. Independent evidence: The signal adds one objective fact about the visit — a mismatch between reported cores and correlated hardware indicators.
2. Cross-checked context: BotRefund tests whether other signals (browser fingerprint, network reputation, device attributes, behavioral patterns) support the same conclusion.
3. AI prediction: A prediction model weighs the complete pattern across all 106 checks instead of trusting any single rule.

This corroboration-first approach is why BotRefund cites 99% accuracy — the model evaluates how all signals fit together rather than relying on a raw threshold.

Limitations and False Positives

The CPU concurrency lie has meaningful limitations. BotRefund explicitly states: "Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people." Examples include:

• Privacy-focused browsers (Brave, Tor Browser) that deliberately mask or randomize hardware signals
• Corporate virtual desktop infrastructure (VDI) where a thin client reports the server's core count
• Legitimate users on rare hardware configurations (e.g., single-core embedded devices, high-core-count workstations)
• Travelers using hotel or airport networks with carrier-grade NAT and shared exit IPs

Because of these false-positive scenarios, the signal is kept as evidence — not a verdict. Any detection system that treats a single fingerprint anomaly as definitive will misclassify real users.

Related Detection Signals

The CPU concurrency check is one of 106 independent signals BotRefund runs. Others in the hardware and behavioral fingerprinting category include:

• Hardware & GPU Fingerprinting: Canvas, WebGL, and WebGPU rendering differences
• window.open Tamper: Detects scripted popup/window manipulation
• Impossible Tab Speed: Flags tab-switching faster than humanly possible
• Ghost Click Detection: Clicks without natural human intent sequence
• Robotic Linear Mouse Movements: Unnaturally straight pointer paths
• Absence of Humanlike Mouse Tremor: Missing micro-jitter in movement
• Superhuman Input Speed (<1ms): Interactions faster than physiological limits
• Grid-Aligned Movement Patterns: Movement snapping to precise lines/blocks
• Unnatural Session Durations: Visits too short, too long, or too uniform

Each signal contributes one piece of evidence. The AI model's strength comes from evaluating how they correlate across a single session.

Practical Implications for Advertisers

If you run Google Ads or Meta campaigns, bot clicks that exhibit the CPU concurrency lie (among other signals) can inflate your costs and poison conversion data. BotRefund's case study with FinTrust, a neobank, showed a 14% average bot click rate on search ad landing pages, with $140,000 in ad spend refunded after suppressing conversion events tied to automated browser signals.

The practical workflow: install a detection script that captures these signals, review the audit report showing which visits carry anomalies like the CPU concurrency lie, then submit evidence-backed refund requests to ad platforms. BotRefund's homepage notes they "prove bot clicks, negotiate with Google and Meta, and get your money back" with refunds dating back to 2017.

Key Facts

Fact	Detail	Source
What it is	Mismatch between reported CPU core count and correlated hardware/behavior signals	S1
Role in detection	One of 106 independent checks; treated as evidence, not a verdict	S1
False positive sources	Privacy tools, corporate VDI, unusual hardware, travel networks	S1
Processing method	Independent evidence → Cross-checked context → AI prediction	S1
Claimed accuracy	99% when all signals are corroborated	S1
Refund lookback window	Google Ads spend dating back to 2017	S3
Setup time	About one minute to add to website	S3

FAQ

Can a legitimate user trigger the CPU concurrency lie?

Yes. Privacy browsers, corporate virtual desktops, rare hardware, and some VPN configurations can produce mismatches that look like the lie. That's why BotRefund treats it as evidence requiring corroboration.

How does this differ from user-agent spoofing detection?

User-agent spoofing checks the browser's self-reported identity string. The CPU concurrency lie checks a hardware-level API (navigator.hardwareConcurrency) against correlated hardware fingerprints like GPU rendering and timing behavior — a deeper consistency check.

Do all bot detection services check CPU concurrency?

Not all. The SERP research shows Kameleo and Botbrowser discuss hardwareConcurrency as a fingerprinting vector, but implementation varies. BotRefund includes it as one of 106 checks; other vendors may use fewer signals or different weighting.

What should I do if my audit shows high CPU concurrency lie rates?

Review the full signal breakdown for those visits. If multiple independent signals (mouse behavior, session duration, network reputation) also indicate automation, consider submitting a refund claim with the evidence package. Isolated CPU concurrency anomalies alone aren't sufficient for a platform dispute.

Can bots fix the CPU concurrency lie?

Sophisticated bots can spoof hardwareConcurrency to match a target device profile, but they must also perfectly align GPU fingerprint, canvas rendering, font enumeration, audio context, and timing behavior — a combinatorial consistency problem that becomes exponentially harder with each additional signal.

How long does a bot audit take?

BotRefund states typical setup is "about one minute" to add the script and start a free bot audit. The audit runs live on your traffic; a detailed report with signal-level breakdown (including CPU concurrency lie) is generated for review.

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

• Hardware Concurrency API - Glossary - Kameleo
• performance.now, hardwareConcurrency, and Timing Fingerprints
• Geekbench 6.7 adds Intel BOT detection to spoof out 'unrealistic' ...

Learn more

Visit the website for more information.