Almost always, it's the address, not you. The popular tools park everyone on one shared domain (linktr.ee, beacons.ai, allmylinks.com). Millions of pages sit on it, and some of them are spam or scams. Instagram and TikTok watch domains, not just individual pages, so once a shared address collects enough reports the platform starts filtering every link on it, and your clean page gets caught with the rest.
Smaller triggers exist too, like a domain registered last week with no track record, or a link dropped into your bio text instead of the Website field. But the shared-domain trap is the one nobody warns you about, because there's nothing on your own page to fix. The way out is a page on a domain with its own clean history, not a shared one.