Tag suspicious activity monitoring