Navigator.hardwareConcurrency vs. Actual Core Count: How Hyper-Threading Reveals Real CPU Architecture

[BadB]

Why 8 logical cores ≠ 8 physical cores – and how this is verified via Web Workers

Introduction: The Core That Makes It All Happen​

You've carefully configured navigator.hardwareConcurrency = 8 in Dolphin Anti. You're confident, "Now my profile looks like a real gaming PC".
But you're instantly banned.
The reason? Not the hardwareConcurrency value, but the actual number of physical cores.

Modern fraud engines (Forter, Sift) use Web Workers to measure parallel task performance to determine:

• Number of physical cores,
• Availability of Hyper-Threading,
• Even CPU architecture (Intel vs AMD vs Apple Silicon).

This is precisely what VPS, VM, and hardware mismatches reveal.

In this article, we'll provide a deep technical analysis of how Web Worker analysis works, why logical cores ≠ physical cores, and how even parallelism can reveal your hardware.

Part 1: What is navigator.hardwareConcurrency?​

Technical definition​

navigator.hardwareConcurrency is a JavaScript property that returns the number of logical processors available to the system.

Example:

console.log(navigator.hardwareConcurrency); // → 8

This value includes:

• Physical cores,
• Logical cores (via Hyper-Threading/SMT).

Key fact:
The value shows the logical cores, but does not reveal the physical architecture.

Part 2: Why 8 logical ≠ 8 physical​

Processor architecture (2026)​

Processor	Physical cores	Logical cores	Hyper-Threading
Intel i5-12400 (Alder Lake)	6P + 0E = 6	12	Yes (P-cores only)
Intel i7-11700 (Rocket Lake)	8	16	Yes
AMD Ryzen 5 5600X (Zen 3)	6	12	Yes (SMT)
Apple M1 (Firestorm)	4P + 4E = 8	8	No
Hetzner VPS (Xen)	2	4	Emulation

Example of anomaly:
You claim Intel i5-12400, but Web Workers show 8 physical cores → system sees: "This is a fake" → fraud score = 95+

Part 3: How Web Workers Reveal Physical Architecture​

Analysis Method: Parallel Load Testing​

Step 1: Starting Web Workers

function createWorker() {
return new Worker(URL.createObjectURL(new Blob([`
const start = performance.now();
// Intensive CPU load
while (performance.now() - start < 100) {}
postMessage('done');
`])));
}

Step 2: Measuring execution time

• N parallel workers are launched,
• The total execution time is measured.

Step 3: Scalability Analysis

• On real physical cores: the time hardly increases up to N=cores,
• On logical cores (HT): time grows faster due to competition for resources.

Example:

• Intel i5-12400 (6P): 6 workers = 100 ms, 12 workers = 180 ms,
• VPS (2 physical): 4 workers = 200 ms, 8 workers = 400 ms.

Part 4: How Fraud Engines Use This Metric​

Analysis process (Forter, Sift)​

Step 1: Collecting Reference Profiles

• The system collects a performance database for real CPUs:
  • Intel i5-12400: 6 physical cores, HT enabled,
  • AMD Ryzen 5 5600X: 6 physical cores, SMT enabled.

Step 2: Compare with the current profile

• If your profile:
  • hardwareConcurrency = 8,
  • But the performance corresponds to 4 physical cores,
• The system sees: “This is a VPS or VM”.

Step 3: Assigning a Trust Score

• Match: low fraud score,
• Mismatch: high fraud score.

CPU identification accuracy for Web Workers: 94% (according to Forter, Q1 2026).

Part 5: How to Test Your Vulnerabilities​

Step 1: Use test sites​

• https://amiunique.org — shows hardwareConcurrency entropy,
• https://browserleaks.com/js — detailed analysis.

Step 2: Run a local test​

function measureCoreCount() {
const workerCount = navigator.hardwareConcurrency;
const promises = [];

for (let i = 0; i < workerCount; i++) {
const worker = new Worker(URL.createObjectURL(new Blob([`
const start = performance.now();
while (performance.now() - start < 100) {}
postMessage('done');
`])));

promises.push(new Promise(resolve => {
worker.onmessage = () => {
worker.terminate();
resolve();
};
}));
}

const start = performance.now();
Promise.all(promises).then(() => {
const duration = performance.now() - start;
console.log(`Time for ${workerCount} workers: ${duration.toFixed(2)} ms`);

// Interpretation:
if (duration < 120) {
console.log('→ 8+ physical cores (bare metal)');
} else if (duration < 200) {
console.log('→ 4–6 physical cores (real CPU)');
} else {
console.log('→ 2–4 physical cores (VPS/VM)');
}
});
}
measureCoreCount();

Rule:
If execution time is >200 ms with hardwareConcurrency = 8 → you are already out.

Part 6: How to Properly Configure Hardware Concurrency​

OS and hardware level​

Windows 10 Pro (bare metal)

• Use real hardware (Hetzner AX41),
• Make sure you are using Intel i5-12400 (6P/12T).

Linux (VPS - not recommended)

• Xen/KVM emulate logical cores, but the performance is equivalent to 2-4 physical cores,
• This gives away VPS → avoid.

Browser level​

Dolphin Anty

1. When creating a profile,
2. In the Hardware section,
3. Install:
   • Hardware Concurrency: 12 (для i5-12400),
   • Device Memory: 8.

The hard truth:
There's no way to fake Web Worker performance.
The only way is to use the right hardware.

Part 7: Why Most Carders Fail​

Common Mistakes​

Error	Consequence
Using VPS/RDP	Performance does not match hardware concurrency → anomaly
Ignoring Web Workers	Thinking that only the hardwareConcurrency value is important → failure
Fake only in JS	Web Workers Reveal Their Real Core Count

Field data (2026):
75% of failures are due to inconsistent hardwareConcurrency.

Part 8: Practical Guide - Secure Profile​

Step 1: Set up RDP​

• Install Windows 10 Pro on bare metal (Hetzner AX41),
• Make sure you are using Intel i5-12400.

Step 2: Check Performance​

• Run the test above,
• Make sure that:
  • hardwareConcurrency = 12,
  • Execution time = 100-150 ms.

Step 3: Avoid custom settings​

• Do not use modified drivers,
• Use official drivers from the manufacturer.

Result:
Your profile will match a gaming PC → low fraud score.

Conclusion: The Core is the New Imprint​

navigator.hardwareConcurrency isn't just a number. It's a fingerprint of your infrastructure that's completely impossible to fake.

Final thought:
True camouflage isn't about faking numbers, but about using the right hardware.
Because in the world of fraud, even the core can give you away.

Stay bare metal. Stay consistent.
And remember: in the world of security, the kernel is the passport.