Scanner identity
How to recognize Paxen in your logs.
Every request carries the user agent PaxenSecurity/0.1 (+https://paxensecurity.com/scanner).
On a domain whose owner has not proved ownership, Paxen reads public certificate and DNS records only, so your servers see no Paxen requests. On a verified domain it sends one GET to each address's home page, requests the paths listed on the capabilities page, and, when the owner switches the test on, sends one form POST per known callback route carrying a Paxen canary address.
Questions or a request to exclude a domain: security@paxensecurity.com.