TLS Attestations are a cryptographic method developed by Security Alliance (SEAL) that produces verifiable proofs of exactly what content a website served during a TLS session, enabling researchers to prove phishing pages despite attacker cloaking and helping to curb large-scale crypto phishing losses.
Published: 2025-10-14 | Updated: 2025-10-14 | Author: COINOTAG
-
TLS Attestations create signed, tamper-evident proofs of web content delivered over TLS for accurate phishing verification.
-
Researchers run a local proxy that captures connection metadata while an attestation server performs cryptographic checks during the TLS handshake.
-
Industry context: more than $400 million was reported stolen in crypto phishing during H1 2025, highlighting urgent need for verifiable reporting.
TLS Attestations enable cryptographic verification of phishing reports to stop cloaked scams and protect users; read how researchers can use it now. (COINOTAG)
What are TLS Attestations?
TLS Attestations are cryptographic proofs produced during a TLS connection that demonstrate what content a server delivered to a particular client session. They allow security researchers to generate verifiable phishing reports showing exactly what a user saw, countering attacker cloaking and enabling defensible takedown or mitigation steps.
How do verifiable phishing reports work?
SEAL’s system uses a trusted attestation server that functions as a cryptographic oracle during a Transport Layer Security (TLS) session. A researcher or affected user runs a local HTTP proxy which intercepts the outgoing connection, captures metadata, and forwards necessary handshake elements to the attestation server. The attestation server performs encryption/decryption operations only for attestation purposes while the actual network traffic remains under the user’s control.
When the attestation server signs the session data, it yields a Verifiable Phishing Report — a cryptographically signed record of what content the target URL served in that session. This proof can be inspected by other researchers, platform defenders, or incident responders without requiring them to visit the malicious site directly, reducing risk and evading common cloaking techniques used by attackers.
The approach addresses a key problem: attackers increasingly serve benign content to scanners and different content to real victims. SEAL explained: “It’s intended to be a tool to help experienced ‘good guys’ work better together, rather than the average user.” They added, “What we needed was a way to see what the user was seeing. After all, if someone claims that a URL was serving malicious content, we can’t just take their word for it.”
Context and references: Security Alliance (SEAL) published the project materials on their GitHub repository (plain text reference). The technical model aligns with Transport Layer Security standards published by the IETF and industry guidance from CERT advisories (plain text references). Industry incident figures cited by security reporting show more than $400 million in crypto-related phishing losses in the first half of 2025, underscoring the practical need for verifiable reporting.
The system workflow in brief:
- Local proxy captures connection metadata and proxies the TLS session.
- Attestation server performs cryptographic operations and issues a signed attestation of the session content.
- The user or researcher submits the resulting signed proof as a Verifiable Phishing Report for verification and remediation actions.
The model deliberately limits exposure: verifiers do not need to visit the malicious site, and the attestation server does not store unnecessary user data. SEAL notes the tool is aimed at advanced users and security researchers only and is not intended as an end-user anti-phishing product.
Frequently Asked Questions
How can researchers submit verifiable phishing reports?
Researchers run the SEAL local proxy and attestation client to capture a TLS session and request a signed attestation from the attestation server. The client produces a Verifiable Phishing Report — a signed record that can be shared with platform defenders or incident response teams without requiring direct access to the phishing site. (40–50 words)
Can TLS Attestations stop phishing right away?
Not by themselves. TLS Attestations enable reliable evidence collection and sharing, improving detection, reporting, and takedown actions. They strengthen the investigative workflow, making it harder for attackers to rely on cloaking, and thereby reduce success rates of phishing campaigns when adopted by the security community.
Key Takeaways
- Evidence-driven reporting: TLS Attestations create cryptographic proof of what a website delivered, closing gaps caused by cloaking.
- Researcher-focused tool: The system is designed for advanced users and security teams to collaborate securely without visiting malicious pages.
- Operational impact: By producing verifiable reports, defenders can accelerate remediation and reduce the effectiveness of phishing campaigns that contributed to $400M+ losses in H1 2025.
Conclusion
TLS Attestations and the associated Verifiable Phishing Reports system from Security Alliance offer a concrete, cryptographic method for proving what content a page delivered during a TLS session. By converting ephemeral user claims into signed evidence, the approach helps researchers and defenders respond to cloaked phishing attacks more effectively. For security teams working on crypto fraud and wider web abuse, adopting verifiable attestation workflows can improve detection, speed up remediation, and strengthen collective defenses. For details and deployment resources, consult Security Alliance materials (plain text reference to SEAL GitHub) and official TLS specifications.
