What makes an unconfirmed tx 'suspicious'? (likely to be replaced or never confirm)
Replacing transactions without confirmation is relatively easy.
I would tag every transaction without confirmation as "suspicious".

RBF is a policy and miners could also replace transaction that do not sign opt-in-RBF.

Best way to check if a 0-conf transactions will be mined soon:


check nSequence number (only accept 0-conf if nSequence number is INT_MAX)
check the transactions fee-rate and compare it with your estimated fee (requires a mempool/bitcoin-core)
Calculate the risks: every 0-conf transaction can be replaced/double-spent! High value items should not be "dispatched" &lt; 6 confirmations (IMO).