Throttled CPU Anomaly

Detection approach

CPU benchmark anomaly: claimed multiple cores but benchmark took way longer than expected. A machine claiming many cores but performing like a throttled VM is a signature of Docker containers or cloud server farms.

How this helps detect bots

This signal is assessed with other independent session, browser, and network evidence. A single anomaly is a lead, not a verdict; corroborating anomalies make automated traffic more likely.

Legitimate traffic to consider

Devices running on low battery (throttled CPU), or heavy background tabs using resources.