If you saw WebhookProof-Check in your logs, the owner of that endpoint (or someone claiming to be) asked us to check it. We send at most 3 requests per check: two POSTs with a synthetic event type webhookproof.probe (livemode false, fake ids) and one GET. They cannot create charges. Checks are rate-limited per host.
To opt a host out, email abuse@webhookproof.com from an address at that domain and include the hostname. It's excluded automatically.