Paste an IP address from your logs and find out if it is a proxy, VPN, Tor exit, data center, or known threat. The kind of traffic that fills out forms and never buys.
Almost all genuine leads come from residential or mobile networks. When a form submission arrives from a data center in another country, something automated sent it. No one shops for a plumber from a rented server.
Click farms and form-filling bots run on cloud servers and route through proxies to look spread out. The network a request comes from is one of the few things they cannot easily fake, which is why it is one of the first things worth checking.
A VPN flag on its own does not make a lead fake. Plenty of privacy-minded people browse through one. It is the combination that convicts: a VPN plus a throwaway email plus a form filled in two seconds is not a customer.