We flag suspicious audiences by combining behavior and composition signals from recent posts - sudden subscriber spikes, abnormal engagement distributions, mismatched audience geo/language vs. creator bio, low reachability, and inconsistent view patterns over the L30D window. Semantic and growth checks reduce false positives.