These auditors specifically are Radically Open Security out of Amsterdam, their website lists their team with names, pictures, and descriptions, I picked one at random and they had a realistic web presence.

There is no way to prove what they are actually running, other than audits. Anything a legit system could send, a malicious one could send too.