IE Mobile 6 Phishing Protection in Windows Mobile 6.5

When Microsoft launched Windows Mobile 6.5, it included Internet Explorer Mobile 6 (IEM6), an upgraded browser built on the desktop Internet Explorer 6 engine with select backported features from Internet Explorer 7 and 8. To combat fraudulent websites, Internet Explorer Mobile 6 integrated several key phishing defense mechanisms, primarily focusing on visual anti-spoofing cues, certificate validation, and script handling to keep mobile users from falling victim to identity theft and credential harvesting.

Domain Highlighting in the Address Bar

Adopted from the desktop release of Internet Explorer 8, domain highlighting served as the primary line of defense against deceptive web addresses. Internet Explorer Mobile 6 visually distinguished the registered top-level domain and second-level domain in black, high-contrast text, while subdomains, paths, and query parameters were subdued in gray. This design made it immediately obvious if a user was visiting an illegitimate address designed to mimic a trusted brand (for example, identifying login.microsoft.com.attacker.com as belonging to attacker.com rather than microsoft.com).

Strict SSL/TLS Certificate Validation

Phishing campaigns frequently rely on forged or improperly configured secure connections to deceive users. IE Mobile 6 introduced more rigorous cryptographic checks for SSL/TLS sessions:

• Immediate Certificate Warnings: The browser blocked immediate navigation and presented prominent full-screen warning prompts when encountering invalid, expired, revoked, or untrusted root certificates.
• Host Mismatch Detection: Alerts triggered if the Common Name (CN) or Subject Alternative Name (SAN) on an SSL certificate did not strictly match the domain entered in the navigation bar.

Visual Security Indicators

The browser’s user interface integrated distinct visual feedback for secure sessions. Whenever a verified HTTPS connection was established, a padlock indicator appeared beside the address bar. Users could tap the security indicator to review the certificate authority and encryption parameters, making it easier to verify the authenticity of banking and enterprise portals.

Script Execution and Redirection Controls

To mitigate automated redirection attacks—where legitimate pages were quickly hijacked to load deceptive phishing forms—IE Mobile 6 tightened its JScript and VBScript execution engines. The browser restricted cross-domain script execution and limited unprompted pop-up windows, reducing the attack surface for deceptive UI overlays that masqueraded as system prompts or login boxes.