The EU-sponsored Maritime Security Centre – Indian Ocean published Advisory 10-2026 on 22 October. The centre has received several reports from shipping companies of e-mails claiming to originate from the Yemeni Coast Guard. The messages request information about vessels’ movements, port calls and operations, particularly in relation to Saudi Arabian ports. The addresses printed on the advisory are [email protected] and [email protected]. MSCIO states that these are not official or verified Yemeni Coast Guard e-mail addresses. In some cases the communications have been accompanied by documents presented as official Yemeni Coast Guard correspondence. The centre advises shipping companies, operators and vessels not to reply to these communications or provide any information concerning vessel movements, port calls or operations. Further communications of this nature should be reported to MSCIO.
That is the working primary. Thursday’s advisory is a numbered phishing and information-security instrument. It is not a UKMTO Warning or Advisory. It is not a rewrite of the dedicated 6 September Yemen Coast Guard detention of Nereida after a Ras Isa call. It is not a rewrite of the dedicated CUL Klang small-craft firing north of Bab el-Mandeb. It is not Warning 176-26 off Al Mukalla, and it is not the still-open Asana hijack. It is not a Hormuz product and not a JMIC Update 107 reprint. The useful facts for a DPA, a master and a shore-side operations desk are the two printed addresses, the Saudi-port targeting of the requests, the fake-document colour, and the instruction not to reply. Masters who brief Thursday as a new Yemeni reporting regime, as a UNVIM filing change, or as a confirmed Houthi “safe-passage” channel will have misread the instrument.
What the advisory actually said
MSCIO Advisory 10-2026 is dated 22 October 2026. The PDF is short. Several shipping companies have reported the e-mails. The claimed origin is the Yemeni Coast Guard. The information sought is vessel movements, port calls and operations, with particular reference to Saudi Arabian ports. Two addresses are named. Both are assessed as not official and not verified. Some messages have come with documents presented as official correspondence. The advice is not to reply and not to provide the information. Report further instances to MSCIO. The centre printed neither a hull, an IMO number, a flag, a named company, a named port of call, a payment demand, nor an attacker. It did not print an official Yemeni Coast Guard address that operators should use instead. It did not print a telephone number, a web portal, or a UNVIM mailbox. Hold the silence. Do not invent a “correct” Coast Guard inbox from this product.
The Saudi-port particular is the operational marker. UKMTO’s Voluntary Reporting Area weekly overview, Report No. 12, produced 23 October, is same-week colour on this desk, not a rewrite of that weekly and not a second dedicated product. That overview said there had been an increase in reporting to UKMTO from vessels of interactions with claimed Yemeni authorities, that no attacks on shipping were reported in the Red Sea and Bab el-Mandeb in the week, that the last such attack on the UKMTO tape remains 24 August, and that the current threat to shipping appears to be in line with the published blockade on Saudi-linked shipping. Advisory 10-26 sits next to that colour: the fake messages ask about Saudi ports. Do not collapse the weekly overview into this advisory, and do not treat the advisory as confirmation that every claimed-Yemeni-authority interaction last week was a phishing e-mail. They are different instruments. One is a weekly VRA summary. The other is a two-address do-not-reply notice.
What this is not
The internationally recognised government’s Coast Guard remains a real constabulary on this desk. The dedicated 9 September Nereida file was a Gulf of Aden intercept after a Ras Isa discharge without UNVIM paper, a live patrol, a reported firing toward the patrol, and an escort to Aden. Thursday’s advisory is not that force sending a new reporting form. It is the centre telling industry that two mailboxes claiming that name are not verified. Do not brief Nereida as the source of these e-mails, and do not brief these e-mails as a new UNVIM or Aden-anchorage procedure.
Houthi-claimed “Yemeni authorities” and the published blockade on Saudi-linked shipping remain a separate threat line. JMIC Update 107, this morning’s dedicated regional note, still has the southern Red Sea, Bab el-Mandeb and Gulf of Aden at SUBSTANTIAL, the last confirmed Houthi merchant attack on that note as 24 August, and Asana still hijacked. Warning 151-26 of 4 October remains the dedicated Mokha explosions file. CUL Klang remains the dedicated 7 October small-craft firing. None of those products is an e-mail advisory. A bridge team that answers a Gmail message because last month’s Coast Guard intercept was real, or because this week’s VRA overview mentioned claimed Yemeni authorities, has given away the voyage list the advisory told them not to send.
UKMTO has not numbered this file. MSCIO has not issued a same-day Attack or Suspicious Activity alert against a named hull on the English primary used. Do not invent a Warning 182-26, an Alert 154/26, or a NAVAREA IX product from two e-mail addresses. Do not move the file onto Hormuz, Fujairah congestion, or Update 107’s 155-incident tally. Those sit on this morning’s dedicated JMIC piece and on Friday’s dedicated 181-26 Limah Attack.
Operational implications
A phishing advisory that names two addresses and a Saudi-port interest is a company-security and bridge-communications problem before it is a Bab el-Mandeb routing change. The requests are for movements, port calls and operations. That is AIS-plus: next port, ETA, cargo interest, whether the voyage is Saudi-linked. A CSO who lets that traffic into the commercial mailbox, the master’s Gmail, or a third-party agency inbox has handed a voyage profile to an unverified sender. MSCIO’s instruction is not to reply and not to provide the information. It is not an order to stop calling Saudi ports. It is not an order to stop reporting to UKMTO, MSCIO or NCAGS on the published channels those centres already print. Keep the official reporting lines. Close the two named addresses.
The document colour matters for the DPA file. Some messages have arrived with papers presented as official Yemeni Coast Guard correspondence. A PDF stamp is not verification. Company security plans that already tell masters not to action attachment-borne “authority” letters without a callback on a known number should treat this advisory as a named instance of that rule, not as a new rule. Do not use the two addresses as a callback. MSCIO did not print a verified Coast Guard mailbox. If a coastal-state request is real, it will come through a channel the company already recognises — flag, agent, UKMTO, MSCIO, or a published government notice — not through [email protected].
The Saudi particular should sit on the war-risk and charter questionnaire, not as a finding that only Saudi-linked hulls are being mailed. MSCIO said “particularly” in relation to Saudi Arabian ports. That matches the published blockade colour on the VRA weekly. It does not mean a non-Saudi voyage can treat the two addresses as harmless. The instruction is industry-wide: companies, operators and vessels, do not reply, do not provide movement or port-call information, report further instances to MSCIO.
Shore-side mail filtering is the cheap control. Add the two printed addresses to the block list. Warn agencies and owners’ offices that a look-alike ycg-yemen.com domain and a Gmail “Sanaa” box are the named pair. Remind masters that a request for the voyage list is a security event even when it arrives in polite English on a letterhead. None of that is a flag circular, a class condition, or a port-state deficiency. It is the numbered advisory. A company that still has no mailbox rule for claimed Yemeni-authority mail after 22 October will have the wrong instrument in the folder.
What Operators Should Note
- Log Advisory 10-2026, 22 October, not a new Yemeni reporting regime. MSCIO: several company reports of e-mails claiming to be the Yemeni Coast Guard, asking for movements, port calls and operations, particularly Saudi Arabian ports. Addresses: [email protected] and [email protected]. Not official, not verified. Some messages carry documents presented as official correspondence. Do not reply. Do not provide the information. Report further instances to MSCIO. This is not a UKMTO numbered product and not a UNVIM change.
- Treat the two addresses as the product, not as a hunt for a “correct” inbox. MSCIO did not print an official Coast Guard mailbox, telephone or portal to use instead. Do not invent one. Keep reporting security events to MSCIO and UKMTO on the channels those centres already publish. A callback on a known company or flag number is still the test for any claimed coastal-state letter. A PDF stamp is not that test.
- Hold the Saudi particular as targeting colour, not as a filter. The messages particularly ask about Saudi ports. UKMTO VRA Report No. 12, 23 October, is same-week colour: more reporting of interactions with claimed Yemeni authorities, and a threat line still described as in line with the published blockade on Saudi-linked shipping. Do not collapse that weekly into this advisory. Do not assume a non-Saudi voyage can answer the mail.
- Do not merge Thursday onto the live Red Sea casualty files. Nereida remains the dedicated 6 September government Coast Guard intercept. CUL Klang remains the dedicated 7 October small-craft firing. 176-26 remains the dedicated Mukalla LNG skiff file. Asana remains hijacked on Update 107. 151-26 remains the dedicated 4 October Mokha explosions file. Thursday adds two fake addresses, not a new Attack.
- Put the block on the company mailbox and the agency desk the same day. Filter the two printed addresses. Warn owners’ offices and port agents. A request for the voyage list is a security event. Do not send AIS-plus data, cargo interest or Saudi-link answers to an unverified sender. This is not an order to leave Saudi ports or to stop official VRA reporting.
- Leave Hormuz and this morning’s JMIC note on their own pieces. Update 107 remains the dedicated 221300 UTC 22 October regional instrument. Warning 181-26 remains Friday’s dedicated Limah Attack. Advisory 10-26 does not move those counters and does not reopen Bab el-Mandeb as a new projectile week. Watch a later MSCIO advisory that names more addresses, a verified official channel, or a named hull that answered the mail — not a Warning 182-26 invented from a Gmail box.
Regulas Shipping will keep lining Advisory 10-2026’s two printed addresses and the do-not-reply instruction against the live Red Sea casualty files and the same-week VRA colour on claimed Yemeni-authority contacts so operators can treat Thursday as a phishing notice, not as a new coastal-state reporting channel.
