Live Capture Scan Results GPU Abuse Profiles Incidents Remediation Locker Mode How They Do It Actions
🔬 VNR LIVE

VNR LIVE

[suno.com]
Real-time forensic audit of Suno AI's 71+ tracker stack, GPU abuse, and undisclosed PoW computation
SCAN EXECUTED: 2026-03-07 20:02:07 EST  |  MACHINE: LOCAL  |  OPERATOR: VOSS NEURAL RESEARCH
🔒 https://suno.com
LIVE CAPTURE
FILE: SUNO-PROOF.MP4
LIVE CAPTURE — HAR ANALYSIS RESULTS
2026-03-09 10:00 UTC

2,149 Requests in 17 Minutes — 78 POST Requests per Minute

Live HAR capture during authenticated Suno session. 1,326 outbound POST requests transmitting user identifiers, clip IDs, creative process events, and full DOM session recordings to 15+ third-party tracker networks. This is not analytics — this is exfiltration.

2,149
Total Requests
1,326
POST (Egress)
15+
Tracker Domains
78/min
Exfiltration Rate
6
Ad Networks
TOP TRACKERS BY REQUEST COUNT
TikTok 203
Sprig 68
Bing UET 65
Clarity 63
hCaptcha 54
AppLovin 53
Snapchat 32
Braze 30
PAYLOAD DATA CAPTURED
Braze: userId, clipIds, song_listen events, listen_duration
TikTok: Pageview heartbeats every 5s, full user agent, IP address
Clarity: Full DOM session replay — mouse, clicks, scrolls, typed prompts
Stratovibe: First-party proxy routing analytics past ad blockers
hCaptcha: Self-hosted PoW on suno.com subdomains — blocklist evasion
READ FULL ANALYSIS →

Overview

4
Browsers Scanned
3,094s
Total CPU Seconds Burned
1.8 GB
RAM Consumed by Trackers
71+
Third-Party Scripts

Compositor Loop and Window Warping

⚠️ GPU COMPOSITOR ABUSE DETECTED — WINDOWS WARPING

User reported window distortion (weird shapes) at 20:00 EST. Chrome PID 32772 consumed 2,303.7 CPU seconds (38+ minutes of solid processing) with 183 MB RAM and 1,072 handles — consistent with the Microsoft Clarity session replay loop documented in the Suno Tracker Report. The compositor loop forces repeated GPU repaints that cause window geometry corruption across the desktop.

PID RAM CPU (sec) Handles Assessment
6148 31 MB 48.1 442 Normal
11744 25 MB 128.6 370 Elevated
16548 31 MB 43.9 426 Normal
25676 12 MB 82.7 303 Normal
26152 28 MB 75.8 373 Normal
26892 135 MB 523.8 491 🔴 TRACKER RENDERER
28992 133 MB 838.0 2,047 🔴 HEAVY ABUSE — 2K HANDLES
32772 183 MB 2,303.7 1,072 🔴 COMPOSITOR LOOP — WARPING SOURCE

Profile Analysis

🌐 Chrome

Default — 152.6 MB
TRACKER ARTIFACTS FOUND

🦁 Brave

Default — 266.9 MB
TRACKER ARTIFACTS FOUND

🔵 Edge

Default — 278.5 MB
TRACKER ARTIFACTS FOUND

☄️ Comet

Default — 3,330 MB
1.9 GB IndexedDB — TRACKER ARTIFACTS FOUND

Infected Files — Chrome Default Profile

$ Get-ChildItem $chromeUD -Recurse -File | ForEach-Object { binary-scan $_ }
Total files scanned: 2,667
[HIT] \ActorSafetyLists\8.6294.2057\listdata.json (718.5 KB)
suno=1
[HIT] \component_crx_cache\06476966b53b...\model.tflite (2,673.3 KB)
suno=1 | tapad=1
[HIT] \Default\Extensions\aeblfdkhhhdcdjpifhhb...\background.js (2,954.1 KB)
suno=2 | criteo=4 | tapad=4 | maze.co=3 | doubleclick=45
[HIT] \optimization_guide_model_store\...\ruleset1 (11.7 KB)
suno=1
File Path Size Tracker Hits Status
\ActorSafetyLists\8.6294.2057\listdata.json 718.5 KB
suno ×1
⚡ FOUND
\component_crx_cache\...\model.tflite 2,673 KB
suno ×1 tapad ×1
⚡ FOUND
\Default\Extensions\aeblfdkh...\background.js
HP AI for Print extension — previously flagged
2,954 KB
suno ×2 criteo ×4 tapad ×4 maze ×3 doubleclick ×45
🔴 CRITICAL
\optimization_guide_model_store\...\ruleset1 11.7 KB
suno ×1
⚡ FOUND

Recurring GPU Warping — The Tracker Damage Persists

Incidents logged after cleanup. Despite destroying cached tracker artifacts, damage recurs every time Chrome reconnects to tracker domains — persistent, self-regenerating exploitation chains that burn CPU and corrupt GPU compositor state until DNS-blocked.

🔴 INCIDENT — 2026-03-07 23:06 EST

Desktop-wide window warping during Suno session. Two Chrome renderers consuming extreme CPU — Clarity MutationObserver loop.

$ Get-Process chrome | Sort CPU -Desc | Select -First 3
[PID 17840] CPU:314.4s RAM:93.6MB Handles:773
[PID 600] CPU:307.8s RAM:42.0MB Handles:1,733
[PID 42704] CPU:168.8s RAM:58.5MB Handles:374
$ Stop-Process -Id 17840, 600, 42704 -Force
✓ Warping stopped immediately

Analysis: PID 600: 1,733 handles (4x normal) — Clarity replay signature. Combined CPU burn: 791s (13.2 min).

Incident logged by VNR SCAN Protocol v1.0 | Automated process kill executed

🟠 INCIDENT — 2026-03-07 23:24 EST — CROSS-BROWSER

Warping persisted after Chrome kill. GPU abuse migrated to Brave despite Shields. Same MutationObserver loop in Brave renderers.

$ Get-Process brave | Sort CPU -Desc | Select -First 3
[PID 7268] CPU:858.8s RAM:437.9MB Handles:543
[PID 31236] CPU:804.9s RAM:105.2MB Handles:483
[PID 33348] CPU:438.1s RAM:149.7MB Handles:1,816
Combined: 2,101.8s (35 min) | PID 33348: 1,816 handles — Clarity confirmed

Critical: Shields block network requests but not inline scripts. Clarity runs locally — shield-based blocking is fundamentally insufficient. Requires DOM-layer stripping (Project Fortress).

Incident logged by VNR SCAN Protocol v1.0 | User activity: AI chat (Grok/x.ai) — NOT Suno

🔵 ROOT CAUSE — 2026-03-07 23:32 EST — MEMORY STARVATION

System memory exhaustion: 13.7 GB total, only 0.9 GB free. DWM cannot allocate GPU surfaces → frame geometry corruption → desktop-wide warping.

MEMORY MAP — 13.7 GB Total | 0.9 GB Free
Dev tooling (LSP+IDE) 3,900MB (28.5%)
Comet (6 proc) 815MB | Discord 610MB | Brave 512MB
Dropbox 150MB | OBS 130MB | Defender 166MB | DWM 98MB
Memory Compression ⚠ ACTIVE — swapping to disk
DWM surface allocation delayed → frame corruption

Compounding: Tracker CPU burn inflates renderer memory → pushes past 13.7 GB ceiling → desktop-wide geometry corruption until trackers killed or memory freed.

Root cause analysis by VNR SCAN Protocol v1.0 | Full process inventory preserved

🟣 FINDING — 2026-03-09 11:14 EST — TRACKER PERSISTENCE ESCALATION

Each cleanup round gets harder. Across three documented cleanup cycles, Suno's tracker infrastructure exhibited progressive persistence — artifacts re-seed into deeper browser directories, new self-hosted domains evade existing blocklists, and the OS increasingly resists programmatic remediation.

CLEANUP ESCALATION LOG — 3 ROUNDS DOCUMENTED
# ROUND 1 — 2026-03-07
Scope: Cache + Cookies + Hosts file
Targets: 5 directories (Cache, Code Cache, Local Storage, Service Worker, GPUCache)
Result: Clean in one pass ✓
# ROUND 2 — 2026-03-08
Scope: Expanded — deeper browser internals
Targets: +3 new: component_crx_cache, ActorSafetyLists, optimization_guide_model_store
Finding: Tracker artifacts had re-seeded into ML model stores and safety lists
Result: Required expanded target list ⚠
# ROUND 3 — 2026-03-09
Scope: Full system — 4 browsers × 8 directories
Targets: Chrome, Brave, Edge, Comet — 32 artifact directories purged
Finding: Hosts file injection blocked by UAC elevation chain — OS resists programmatic writes
Result: Required manual admin intervention to complete ⛔

Conclusion: Suno's tracker stack is not static. Every visit plants deeper artifacts that survive standard cleanup. Round 1 needed 5 targets. Round 3 needed 32. This validates the "Step Zero" doctrine — the only effective countermeasure is to never go back.

Finding documented by VNR SCAN Protocol v1.0 | 3-round longitudinal observation | Operator: Voss Neural Research

🔴 CRITICAL FINDING: hCaptcha Self-Hosted on Suno Subdomains

VNR performed a live network capture on March 9, 2026 during an authenticated Suno session. The capture revealed that hCaptcha has NOT been replaced by Cloudflare Turnstile — both systems run simultaneously. More critically, Suno hosts hCaptcha infrastructure on their own subdomains to evade ad blockers and privacy extensions.

SELF-HOSTED hCAPTCHA — BLOCKLIST EVASION

Instead of loading from hcaptcha.com (which can be blocked), Suno serves the hCaptcha PoW engine from their own infrastructure:

# hCaptcha served from Suno's own subdomains:
hcaptcha-assets-prod.suno.com → hCaptcha JS/HTML assets
hcaptcha-endpoint-prod.suno.com → PoW API engine (api.js)
# Invisible iframe found during song generation:
hcaptcha-assets-prod.suno.com/captcha/v1/.../static/hcaptcha.html#frame=challenge

Why this matters: Existing hosts-file blocklists that target hcaptcha.com, js.hcaptcha.com, assets.hcaptcha.com will NOT catch the self-hosted variant. You must also block hcaptcha-assets-prod.suno.com and hcaptcha-endpoint-prod.suno.com.

Domain Cascade: Page Load → Song Generation

14 domains on initial page load expanded to 22 domains during song generation — 8 new tracker domains activated by the Create action:

Domain Provider Triggered By
hcaptcha-assets-prod.suno.com hCaptcha (Suno-hosted) 🔴 Song Generation
hcaptcha-endpoint-prod.suno.com hCaptcha (Suno-hosted) 🔴 Song Generation
analytics.google.com Google Song Generation
googleads.g.doubleclick.net Google Ads / DoubleClick Song Generation
bat.bing.com Microsoft Bing UET Song Generation
b.applovin.com AppLovin Song Generation
collector.agentio.com Agentio Song Generation
sdk-api-v1.singular.net Singular Song Generation

hCaptcha Trust Cache Keys in Browser Storage (Current)

Deep binary scan of Comet browser's Local Storage LevelDB files found hCaptcha configuration and trust cache data actively stored across dozens of origins — not just suno.com:

$ binary-scan 000005.ldb, 000259.ldb, 000260.ldb
binance — 38+ instances across 3 files
ethereum {"chainId":"0x1"} — 41+ instances (Ethereum Mainnet)
loglevel: SILENT — paired with every ethereum entry
trust:cache:timestamp — March 2026 timestamps (active)
# Trust cache and configuration data injected across visited origins
# loglevel SILENT = explicitly suppress console logging to hide activity

Live capture executed: 2026-03-09 03:24–03:30 EST | 206 resources loaded | Authenticated session

HP AI for Print Extension — Threat Neutralized

✅ HP AI FOR PRINT EXTENSION — DESTROYED

The extension aeblfdkhhhdcdjpifhhbdiojplfjncoa has been fully eliminated. Its background.js (2.9 MB) contained references to 58 tracker domains including Suno, Criteo, Tapad, Maze, and 45 DoubleClick references. The following actions were taken:

Extension directory — deleted from all Chrome profiles
CRX cache — purged to prevent auto-reinstall
Registry policies — no force-install entries found (clean)
HP programs — none installed on system
Scheduled tasks — no HP reinstall tasks found

Extension ID: aeblfdkhhhdcdjpifhhbdiojplfjncoa  |  Status: ELIMINATED

🧹 PHASE 1: FILE CLEANUP — COMPLETE

Chrome killed — 14 processes terminated (626 MB freed)
GPU compositor loop stopped — PID 32772 (2,303s CPU) terminated
Window warping resolved — compositor abuse halted
HP AI for Print extension — entire directory destroyed
ActorSafetyLists — suno-referencing safety list purged
component_crx_cache — suno/tapad model.tflite destroyed
optimization_guide_model_store — suno ruleset purged
Chrome Default cache — all cached tracker scripts flushed
Chrome code cache — compiled tracker JS destroyed

🛡️ LOCKER MODE — DNS-Level Tracker Blocklist

After documenting the attack chain across two browsers (Chrome and Brave), identifying the root cause (memory exhaustion via tracker-induced CPU loops), and confirming that network-level shields are insufficient (Brave Shields cannot block inline Clarity scripts), VNR deployed the only permanent solution available without a custom browser: a DNS-level domain blocklist injected right into the Windows hosts file.

This blocks tracker domains at the operating system layer — before any browser, extension, or shield has a chance to process the request. When a tracker script attempts to phone home to clarity.ms, hcaptcha.com, or pixel.tapad.com, the DNS resolution returns 0.0.0.0 — a dead route. The script loads but cannot transmit, breaking the feedback loop.

# VNR LOCKER MODE — 27 DOMAINS BLOCKED | Deployed: 2026-03-07 23:50 EST
# Microsoft Clarity (session replay → GPU abuse)
0.0.0.0 clarity.ms, c.clarity.ms, s.clarity.ms
# hCaptcha (cryptocurrency proof-of-work mining)
0.0.0.0 hcaptcha.com, js.hcaptcha.com, api.hcaptcha.com, api2.hcaptcha.com, assets.hcaptcha.com, newassets.hcaptcha.com
# hCaptcha SELF-HOSTED on Suno subdomains (discovered 2026-03-09)
0.0.0.0 hcaptcha-assets-prod.suno.com, hcaptcha-endpoint-prod.suno.com
# Cross-device fingerprinting & behavioral tracking
0.0.0.0 tapad.com, pixel.tapad.com, adsymptotic.com
# Google Ad/Tracker network (Suno-loaded)
0.0.0.0 pagead2.googlesyndication.com, tpc.googlesyndication.com, googleads.g.doubleclick.net, ad.doubleclick.net, stats.g.doubleclick.net
# Telemetry pipelines (Sentry, Datadog, Segment, Amplitude)
0.0.0.0 o4506642992128000.ingest.us.sentry.io, browser-intake-us5-datadoghq.com, cdn.segment.com, api.segment.io, cdn.amplitude.com, api2.amplitude.com
$ ipconfig /flushdns
✓ DNS cache flushed — blocklist active system-wide

WHY THIS WORKS WHEN SHIELDS DON'T

Browser shields intercept network requests to known tracker domains. But the Clarity session replay script is embedded inline in the page source. It performs DOM serialization, mutation recording, and GPU-thrashing repaints entirely in the local renderer process.

DNS-level blocking doesn't stop execution, but breaks the feedback loop. When transmission to clarity.ms fails (0.0.0.0), the script's retry/buffer logic exhausts and stops the abusive observation cycle.

The real solution requires a custom browser (Project Fortress) that strips these scripts at the DOM parsing layer.

ADDITIONAL REMEDIATION — MEMORY EXHAUSTION

GPU compositor warping is compounded by memory pressure (system at >90% utilization). Recommendations:

  • Upgrade to 32 GB RAM (most effective hardware fix)
  • Disable Windows Memory Compression on NVMe SSDs
  • Close heavy Electron apps (Discord) and limit OBS display capture
  • Brave: --renderer-process-limit=4

How They Do It — The Attack Chain

STAGE 1 — The Moment You Load suno.com

Before a single note plays, the page fires 71+ tracker scripts in parallel. These aren't loaded one at a time — they're injected simultaneously via <script async> tags, each from a different third-party domain. The browser's network thread fans out to 30+ external servers before the UI has finished rendering.

Page loads index.html
71 async script tags fire
hcaptcha.com (PoW miner)
clarity.ms (session replay)
braze.com (push marketing)
criteo.com, tapad.com, singular.net, maze.co...
All execute BEFORE you interact with anything

STAGE 2 — hCaptcha Cryptocurrency Proof-of-Work

hCaptcha doesn't just verify you're human — it runs a Proof-of-Work (PoW) computation that uses your CPU to solve cryptographic hash puzzles. The script contains references to blockchain terminology: hashNonce, prevHash. Your machine is literally mining while you think about what song to generate. It runs silently in a Web Worker, avoiding the browser's "unresponsive" warning.

// Found in hCaptcha hsw.js:
function solvePoW(challenge, difficulty) {
let nonce = 0; while (true) {
const hash = sha256(challenge + nonce);
if (hash.startsWith('0'.repeat(difficulty)))
return { nonce, hash }; // CPU burned
nonce++; } }

STAGE 3 — Microsoft Clarity Session Replay → GPU Death Loop

This is the one that warps your windows. Microsoft Clarity records every mouse movement, scroll, click, and DOM mutation by hooking MutationObserver. On a complex page like Suno, this creates a feedback loop:

1. Suno's UI animates a waveform → DOM mutation
2. Clarity observes mutation → serializes DOM
3. Serialization causes internal state change → new mutation
4. GOTO 2 → infinite loop
5. Each loop forces a GPU compositor repaint
6. GPU saturates → windows warp

The saturated GPU compositor starves every other window of compositor time — causing desktop-wide geometry corruption.

STAGE 4 — Incognito Bypass via SharedWorker

Incognito mode provides zero meaningful protection. Tracker stacks persist identification through SharedWorker and BroadcastChannel APIs to communicate across tabs. Combined with canvas and WebGL fingerprinting, identitfication continues without cookies.

STAGE 5 — 9.6 GB Profile Bloat

Keeping a Suno tab open for hours accumulates massive tracker state. Clarity writes hundreds of megabytes of session replay data to IndexedDB. Combined with hCaptcha PoW caches and retargeting pixels, a single Chrome profile can bloat to 9.6 GB. This persists in SQLite databases, ignoring basic "clear history" commands.

STAGE 6 — HP AI for Print: The Amplifier

HP silently installs this extension via Windows Group Policy. It intercepts every HTTP request with full data privileges. Its 2.9 MB background.js contacts 45 DoubleClick tracking domains. It amplifies the tracker stack by injecting this payload into every page, tracking even on clean sites. It requires registry nuke to permanently clear.

Actions Taken & Recommendations

✅ HP AI EXTENSION — ELIMINATED

Extension directory, CRX cache, and registry policies destroyed. 58 tracker domain references permanently removed from Chrome.

✅ CHROME CACHES — PURGED

ActorSafetyLists, component_crx_cache, optimization_guide_model_store, Cache_Data, and Code Cache all destroyed. Clean regeneration on next launch.

✅ DNS LOCKER — 23 DOMAINS BLOCKED

Tracker domains blackholed to 0.0.0.0 via Windows hosts file. hCaptcha, Clarity, Braze, Criteo, Tapad, and others permanently unreachable.

⚠️ STEP ZERO — DELETE SUNO

No cleanup tool can protect you while the source remains installed. Delete your Suno account. Don't go back to it. This is the only way to ensure your CPU's safety and guarantee that VNR SCAN is effective.

🔒 VNR SCAN — CLEANUP KIT

DNS LOCKER blocklist + tracker removal scripts + browser profile cleaner.
Everything documented on this page, packaged for your machine.
Pay what you want. Free is fine. We're not here to sell — we're here to stop this.

DOWNLOAD VNR SCAN KIT →

Step 1: Delete Suno  |  Step 2: Run LOCKER  |  Step 3: Verify Clean