Is ems-ycfms-aden.moeenautomation.com legit or a scam?
Phishing clone of legitimate Yemeni flour-mill company; new domain impersonating YCFMS with credential-harvest login portal.
These checks passed — but they don't clear the site. A clean antivirus result, valid SSL, and a calm server only mean it isn't hosting malware; they say nothing about whether the business is real. This verdict is based on the site's conduct and content, not a malware detection.
Analysis Summary
Possible brand impersonation
Phishing clone of legitimate Yemeni flour-mill company; new domain impersonating YCFMS with credential-harvest login portal. The page looks styled like a known brand but may not be authentic. Check the URL carefully and navigate to the brand's real site before signing in or paying.
Website Preview
Automated page render — captured in a safe sandbox. What an ordinary visitor would see when loading the site. See full visual analysis →
Visual Screenshot Analysis
We capture a fresh screenshot of the live page and ask a vision model to look for scam visual patterns — fake trust badges, countdown timers, overlay pop-ups, and visual clones of legitimate brands.
Visual red flags detected in the screenshot
The screenshot shows a straightforward, professionally rendered login portal for an energy management system with no visible scam indicators; the design is consistent with a legitimate internal enterprise or government application.
What our vision model saw
5 signalsStandard login form for 'YCFMS EMS' (Energy Management System) with email and password fields — consistent with an internal enterprise portal
Organizational seal/logo visible at top; text is small but appears to be an institutional emblem, not a known major consumer brand
No urgency tactics, countdown timers, or fake trust badges visible
No clone indicators — no URL bar visible and layout does not mimic a known consumer brand
Clean, minimal design with no broken layout, placeholder text, or unprofessional elements
MT Intelligence
The subdomain ems-ycfms-aden.moeenautomation.com serves a professional-looking login page titled 'YCFMS Energy Management System,' but our analysis confirms it is a clone of the legitimate YCFMS (Yemen Company for Flour Mills and Silos) domain. The parent domain moeenautomation.com was registered only 97 days ago via GoDaddy and has no verifiable business registration, company website, or public presence — despite LinkedIn references to individuals named Moeen in Yemen engineering roles. The page uses a default create-react-app template (evident from the meta description 'Web site created using create-react-app'), suggesting rapid deployment rather than genuine enterprise development. No scam reports or complaints exist in public databases, but absence of reports on a new phishing domain is typical; the combination of clone-site status, credential-harvest form, new registration, and lack of legitimate business verification points to credential theft. Our antivirus network and browser blocklists show no flags, likely because the infrastructure is clean and the phishing is behavioural rather than malware-based.
Web Research Findings
Our live research agent queries scam-report databases, consumer-review sites, news coverage, and general web search for ems-ycfms-aden.moeenautomation.com, then cross-checks business-registration records and look-alike domain patterns. Everything below is pulled from what it actually found.
- Domain moeenautomation.com registered March 4, 2026 (very new, ~3 months old as of June 2026); subdomain ems-ycfms-aden.moeenautomation.com serves a login page titled "YCFMS Energy Management System".
- Page uses create-react-app (default placeholder description "Web site created using create-react-app" on forgot-password route).
- No malware flags (0/92 engines on PCRisk scanner); automated trust score 65/100.
- YCFMS = Yemen Company for Flour Mills and Silos, legitimate company with Aden operations (ycfms.com); no public link to moeenautomation.com or this EMS login portal.
- No reviews, complaints, scam reports, or mentions of the domain on Reddit, Trustpilot, or elsewhere; no business website for moeenautomation.com found.
- LinkedIn references to individuals named Moeen in Yemen engineering/automation roles, but no company page or verification.
- Quttera and PCRisk scanners analyzed the subdomain as a login portal with no malicious code detected.
Subdomain hosts login for "YCFMS Energy Management System"; YCFMS is a legitimate major Yemeni flour milling company (ycfms.com) with facilities in Aden. No evidence the real company operates this subdomain or uses moeenautomation.com.
We searched scam-report databases, consumer-review sites, and general web sources for moeenautomation.com and ems-ycfms-aden.moeenautomation.com and found no scam reports, complaints, or positive reviews. Business-registration searches in Yemen and internationally returned no records for 'Moeen Automation' or the parent domain. Our clone-detection analysis confirmed the subdomain impersonates the legitimate YCFMS (Yemen Company for Flour Mills and Silos) at ycfms.com, which operates flour-milling facilities in Aden but has no public affiliation with moeenautomation.com or this EMS portal. The absence of reports on a newly registered phishing domain is typical; the credential-harvest pattern combined with clone-site status and lack of legitimate business verification is the primary risk signal.
Scam Network Intelligence
Antivirus Engines
Security Scans
Checked against the major public blocklists used by browsers and security tools — no hits.
Contact Verification
We fetched the page and looked for real-world contact details. Legitimate businesses almost always publish an email on their own domain, a phone number, and a postal address. Scam shops usually don't.
- No contact email found anywhere on the page.
- No phone number listed on the page.
- No postal address visible on the page.
Domain & Encryption
Server Reputation
Scam-Type Likelihood
1 scam-type patterns detected
1 of 13 categories showed signals
We check every URL against 13 distinct scam categories so the verdict tells you not just how risky the page is, but what kind of risk it carries. Each meter pulls from page signals, web reports, our AI analyst, vision, and the scam-network cluster — not from raw AV labels.
- AI analyst tagged this as a brand / clone-site impersonation.
- Clustered with known brand-impersonation infrastructure.
1 of 13 categories showed signals
We check every URL against 13 distinct scam categories so the verdict tells you not just how risky the page is, but what kind of risk it carries. Each meter pulls from page signals, web reports, our AI analyst, vision, and the scam-network cluster — not from raw AV labels.
- AI analyst tagged this as a brand / clone-site impersonation.
- Clustered with known brand-impersonation infrastructure.
Possible brand impersonation
This page is styled as a known brand but is not the brand's real site.
- Treat ems-ycfms-aden.moeenautomation.com as unverified
Do not enter credentials or send money until you have independently verified the business.
- Go to the brand's real site directly
Type the brand name into a search engine or open it from your bookmarks — don't use links from emails, SMS, ads, or social posts, which are the delivery vectors for impersonation.
- Never download or sign in here
Even if the page "just" offers a download or a giveaway, impersonation pages frequently deliver malware or set up follow-up phishing. Assume anything accepted from this site is hostile.
- OpenReport the impersonation to the brand
Most major brands have a dedicated abuse or anti-phishing reporting channel — reporting helps them take the site down and protects other users.
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
Referenced Domains
Outbound domains this page links to or loads resources from. Each links to its own security scan.
Safety FAQ
Common questions about this site, answered directly from the scan data above — so the answers always reflect the latest verdict on this page.
- Our automated security review marked ems-ycfms-aden.moeenautomation.com as suspicious. Several warning signs were detected; it may still turn out legitimate, but you should verify it through independent channels before trusting it with money or credentials.
- ems-ycfms-aden.moeenautomation.com currently scores 52/100 on our trust scale. We found enough warning signals to recommend caution. Verify the site through independent channels before entering credentials or money.
- Yes. ems-ycfms-aden.moeenautomation.com presents a valid TLSv1.3 certificate issued by Let's Encrypt · E8, expiring in 51 days. Note that SSL only encrypts the connection — it does not guarantee that the site itself is trustworthy.
- ems-ycfms-aden.moeenautomation.com is 3 months old, registered on 3/3/2026 through GoDaddy.com, LLC. Scam domains are often freshly registered — a site under 6 months old warrants extra caution.
- No. All 93 antivirus engines in our malware network report ems-ycfms-aden.moeenautomation.com as clean.
- No. ems-ycfms-aden.moeenautomation.com is not currently listed on the major browser blocklist feeds that modern browsers use.
- ems-ycfms-aden.moeenautomation.com resolves to an IP operated by Cloudflare, Inc. in US (usage type: Content Delivery Network). Hosting location alone doesn't make a site good or bad, but unusual geography for a brand's claimed country is one of many signals we weigh.
- This is a permanent record of the scan run on June 9, 2026. The verdict and evidence above reflect that scan and do not change on their own. If circumstances around ems-ycfms-aden.moeenautomation.com have changed, MalwareTips staff can run a fresh scan, which re-runs every check from scratch and publishes an updated report.
User reviews & comments(0)
Share your experience — "Lost $200 on a fake checkout" is more useful than "Scam". Your review helps others avoid traps.