When Should You Worry About a Single CPU Concurrency Anomaly?

Most CPU concurrency mismatches come from legitimate sources: privacy tools, corporate proxies, unusual hardware, or a traveler on a hotel network. BotRefund's own documentation states clearly: "A single anomaly is not a bot verdict." The signal is kept as evidence and weighed against independent browser, network, device, and behavior data before any decision is made.

You should escalate concern only when the anomaly is extreme (e.g., reported core count contradicts GPU tier), when it occurs during low-traffic hours where automated scripts often run, or when it appears with other red flags such as missing mouse tremor, grid-aligned movement, or superhuman click speeds. The checklist below helps you decide whether to investigate, monitor, or dismiss a single CPU concurrency flag.

What a CPU Concurrency Anomaly Actually Means

The CPU Concurrency Lie check compares the number of logical processors the browser reports with the hardware capabilities implied by the GPU, fonts, audio stack, and OS details. A real device usually shows a consistent profile: a MacBook Pro reports both its CPU cores and its Metal GPU family. A headless Chrome instance on a virtual machine might claim 16 cores while presenting a software renderer with no matching GPU.

BotRefund lists this as one of 106 independent checks used to build a reliable picture of whether a visit is human or automated. The check looks for "a mismatch that a real browsing session does not normally create." Virtual machines and spoofed profiles often claim one device while their graphics, fonts, audio, or processor behavior tells another story.

Readiness Checklist: When to Worry

1. Extreme mismatch. The reported core count is physically implausible for the claimed device class (e.g., 64 cores on a consumer laptop GPU).
2. Off-peak timing. The anomaly appears disproportionately between midnight and 4 AM local time, when human traffic is low but scrapers run.
3. Companion anomalies present. At least two other independent signals flag the same session: missing mouse tremor, grid-aligned pointer paths, superhuman input speed (<1 ms), ghost clicks, or honeypot interactions.
4. Repeated pattern. The same anomaly recurs across multiple sessions from the same IP subnet or fingerprint cluster within a short window.
5. Conversion impact. Sessions with the anomaly show zero engagement (no scroll, no click, no form interaction) but still register ad clicks.

If three or more of these conditions are true, treat the session as high-risk and prioritize it for refund evidence collection. If only one or two apply, keep monitoring; the anomaly alone is not actionable.

When to Monitor Instead of Act

Several legitimate scenarios produce CPU concurrency mismatches without any automation:

• Privacy tools. Anti-fingerprinting extensions (e.g., CanvasBlocker, Trace) deliberately randomize or mask hardware signals.
• Corporate networks. Enterprise VDI or remote-desktop gateways present virtualized hardware that differs from the employee's physical device.
• Travel and unusual devices. A user on a hotel Wi-Fi, a borrowed tablet, or a rare Linux laptop may trigger a mismatch.
• Browser updates. New Chrome or Firefox releases occasionally change how navigator.hardwareConcurrency is reported on certain platforms.

BotRefund explicitly notes that "privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people." In these cases, the signal stays as evidence and is cross-checked rather than triggering a block.

How Cross-Checking Changes the Verdict

BotRefund uses a three-step process for every signal, including CPU concurrency:

1. Independent evidence. The signal adds one objective fact about the visit.
2. Cross-checked context. The system tests whether other signals support the same story.
3. AI prediction. The model weighs the complete pattern instead of trusting a raw rule.

This corroboration approach is why BotRefund claims 99% accuracy: "Accuracy comes from corroboration, not one browser tell." The prediction AI evaluates the complete picture across browser, network, device, and behavior evidence. A single CPU anomaly might nudge the score slightly, but it cannot override a clean behavioral profile.

Decision Framework for Analysts

Use this table as a quick reference during log review. The key principle: one signal is a clue; a pattern is a case.

Key Facts from BotRefund's Detection Model

Limitations of This Guidance

• This checklist applies to client-side browser fingerprinting signals, not server-side CPU metrics (e.g., container orchestration anomalies).
• Thresholds for "extreme mismatch" depend on your traffic composition; a site with heavy developer traffic sees more legitimate Linux/VM profiles.
• BotRefund's 99% accuracy claim is based on their internal model; independent verification is not provided in the source pack.
• The framework assumes you have access to session-level behavioral data (mouse movement, click timing, scroll depth). Without it, you cannot apply the companion-anomaly rule.

Terminology Quick Reference

CPU Concurrency Lie

BotRefund's name for the check that compares navigator.hardwareConcurrency against GPU, font, audio, and OS fingerprints.

Independent evidence

A single signal that adds one objective fact without deciding the verdict.

Cross-checked context

Testing whether other independent signals support the same conclusion.

AI prediction

The final model that weighs all signals together rather than applying hard rules.

Ghost click

Click activity without the natural sequence of human intent (e.g., no prior hover, no focus change).

Honeypot interaction

Response to hidden or deceptive page elements that real users never see.

FAQ

Can a VPN cause a CPU concurrency anomaly?

A VPN alone does not change navigator.hardwareConcurrency. However, corporate VPNs that route through VDI or remote-desktop gateways can present virtualized hardware that mismatches the user's physical device.

What is the most common false positive for this check?

Anti-fingerprinting browser extensions that randomize or mask hardware signals. They intentionally break the consistency between CPU, GPU, and OS reports to prevent tracking.

How many companion anomalies make a single CPU flag actionable?

Two or more additional independent signals (e.g., missing mouse tremor + superhuman input speed) from the same session. BotRefund's model requires corroboration across categories: browser, network, device, and behavior.

Does BotRefund block traffic based on this signal alone?

No. The documentation states the signal is "kept as evidence—not a verdict—and cross-checks it against independent browser, network, device, and behavior data."

What should I do if I see a spike in CPU anomalies after a browser update?

Wait 48–72 hours. Browser releases occasionally change hardware reporting. If the spike persists and correlates with zero-engagement ad clicks, treat it as suspicious.

Can I use this checklist without BotRefund?

You can apply the logic if you collect the same client-side signals (hardwareConcurrency, WebGL renderer, font enumeration, mouse movement, click timing). Without the 106-signal corpus and AI model, your false-positive rate will be higher.