Cyprus has long been synonymous, in the utility monitoring community, with a single name: Akrotiri (DHFCS/RAF). The island's dense HF military traffic tends to get filed under that one well-documented facility almost by reflex — and for good reason, given how thoroughly its fingerprint has been logged over the years. This post starts from an unusual waveform intercepted on 18503.0 kHz that doesn't quite fit that story.
| 18503.0 kHz/USB — the signal at the center of this investigation |
What follows is an attempt to characterize it properly, before eventually asking a question that felt worth asking: what if, this time, it isn't Akrotiri at all?
A note on the post structure: Sections 1 through 3 are essentially about establishing what this signal actually is — confirming its identity as a 75 bps STANAG-4415/MS-110A waveform, down to the preamble structure, the lack of mini-probes, and its cryptographic fingerprint. If you're here mainly for the "who's transmitting" question, Section 4 is where that discussion happens, and you're welcome to jump ahead. But that identification work is what turns the final hypothesis into something more than a guess — so if you have the patience for it, it's worth the detour.
Fair warning: the technical analysis is solid, but the attribution that follows it is a personal hypothesis, offered for what it's worth — and, as always, open to correction.
Transmission received on 18503.0 kHz/USB, first logged by me on 19 August 2026, and monitored regularly, though not continuously, since. Although the transmission looks, to the naked eye on the waterfall, like a classic STANAG-4285 fleet broadcast, its "sound" and subsequent analysis reveal a serial waveform of the MS-110A type operating in 75 bps Long Interleaver mode — a rather unusual configuration that prompted a closer look. Captures, recordings, and waterfall screenshots thanks to the KiwiSDR receivers kindly shared by my friend Linkz [1].
Notably, the transmission scheme is not a typical 24/7 active fleet broadcast; instead, it alternates between "off" states and active periods (for either short or extended periods). The transmissions start "out of the blue", without prior ALE sounding or handshake calls. This points either to scheduled transmission windows (though not strictly starting on the hour or half-hour) or to receivers parked on the listening frequency (18503.0 kHz).
In this regard, I have repeatedly noticed transmissions beginning in the morning around 06:50 UTC, lasting just a few minutes (recordings available in the Downloads section at the bottom of the post). I cannot confirm this to be a fixed daily start time, but such repetition seems unlikely to be mere coincidence.
Transmissions may consist of isolated single messages or extended continuous streams containing multiple messages — which are not necessarily contiguous. In the latter case, individual messages within the stream remain identifiable by their distinct preambles, which likely serve to trigger or re-synchronize waiting receivers. This behavior is otherwise consistent with NATO broadcast protocols.
## 1. Waveform analysis and confirmation
Figure 1 shows the initial SA (Signals Analyzer) demodulator lock on the intercepted signal: a carrier at 1801.29 Hz (USB, +1801.4 Hz offset), a symbol rate of ~2400.22–2400.33 Bd, and an 8-ary constellation — all consistent with the 2400 Bd, 8-PSK tribit-symbol architecture shared across the MS-110A serial-tone family.
The decoding software used correctly classifies the signal as MS-110A, tagging it "110A/75L" — i.e. the 75 bps mode with the long interleave setting. It's worth noting, however, that at the waveform level this 75 bps mode is identical to STANAG-4415's NATO Robust Waveform — same DSSS (Direct Sequence Spread Spectrum)(1) Walsh modulation, same fixed 2400 Bd symbol rate — so for logging purposes labeling the signal definitively as "MS-110A" or "STANAG-4415" from its RF fingerprint alone isn't strictly accurate.
| Figure 1: Signal acquisition and demodulator lock; arrow marks the preamble at the start of a new message. |
As mentioned, at the waveform level STANAG-4415 and MS-110A are the same signal and fully interoperable, but STANAG-4415 layers stricter performance/conformance requirements on top of what MS-110A specifies natively. MS-110A is a broad US standard covering an entire family of serial- and parallel-tone HF modem waveforms; the 75 bps robust mode is just one entry in that family. STANAG-4415, by contrast, is a narrowly-scoped NATO standard dedicated only to that robust 75 bps mode.
The relationship got formalized over time: MS-110B (dated 2000) §5.3.1.3.h explicitly lists the robust 75 bps mode as an optional mode, stating it "shall be in accordance with STANAG 4415" — i.e., in the newer US MIL-STDs (110B, 110C, 110D), the robust 75 bps entry is defined by reference to STANAG-4415 rather than re-specified in-house, whereas 110A originally carried its own native 75 bps definition before this harmonization. As per MS-110B (dated 2000) §5.3.4: "The optional robust serial tone mode shall employ the waveform specified above for 75 bps operation, and shall meet the performance requirements of STANAG 4415".
Where the difference actually exists is on the receiver design side, not the bitstream side: a modem built to fully meet the STANAG-4415 spec will have a receiver capable of decoding at much lower SNR (down to roughly -9/-11 dB in 3kHz AWGN) than a receiver that only implements the baseline MIL-STD-188-110A target — but this is a performance difference, measurable only through comparative lab testing (BER vs SNR/multipath/Doppler), not something the modem can read or infer from a single intercepted burst.
![]() |
| Figure 2: Harris RF-5710A front panels displaying the two equivalent modulation settings: STANAG-4415 (top) and SERIAL MS-110 mode (bottom). |
Neither STANAG-4415 nor the MS-110A 75 bps mode uses mini-probes. Mini-probes (periodic resync sequences) only appear in serial-tone waveforms with 150–4800 bps rates (Figure 3a), needed there because long burst duration allows channel drift between preamble and end-of-transmission. 75 bps mode doesn't need it: DSSS Walsh spreading at fixed 2400 Bd is inherently redundant per bit, so channel tracking/noise immunity comes from the spreading itself, not periodic re-training. Thus, a single preamble without mid-stream mini-probes cannot support late-entry acquisition, further justifying the above hypothesis of parked receivers standing by on a pre-assigned frequency.
| Figure 3a: MIL-STD-188-110A, Table XIX: the 75 bps row shows 0 known symbols, confirming the absence of mini-probes at this rate. |
Although the use of Walsh modulation is formally specified in the reference standards (STANAG-4415 and MS-110A), its presence can be directly verified through carrier regeneration via the squarer/m-th power loop technique implemented in SA.
The presence of a clean spectral line at exponent n=2 in the non-linear analysis (Figure 4, center) provides mathematical proof that the preamble carries an underlying BPSK-type modulation associated to Walsh chips. Squaring a two-state structure (0°/180°) collapses the phase, producing a single coherent line. With exponent n=8 (Figure 4, bottom) this spectral line vanishes completely across both preamble and data sections, confirming that the underlying signal is a masked BPSK rather than a native 8-PSK modulation.
Although the data payload also employs BPSK-mapped Walsh modulation followed by 8-PSK scrambling, the spectral line at n=2 is confined to the preamble. This is because the preamble uses a fixed, highly repetitive PN synchronization sequence; the combination of BPSK phase symmetry and strict structural periodicity concentrates the squared energy into a discrete peak. Conversely, the data payload transmits high-entropy user data.
While squaring (n=2) mathematically removes the BPSK phase transitions from individual Walsh chips, the non-repetitive, pseudo-random nature of the payload (further randomized by interleaving) spreads the energy evenly across the bandwidth, dissolving the discrete tone into the spectral noise floor.
As per MS-110A §5.3.2.3.7.2.1 "The synchronization pattern shall consist of either three or twenty four superframes (depending on whether either zero, short, or long interleave periods are used)", as illustrated in Figure 5a. It is possible to analyze the initial synchronization preamble preceding the data (Figure 5b).
The 200 ms ACF value is compliant with the sync pattern of MS-110A. The 4.8 s length of the sync preamble indicates the long interleaver setting with its 24 superframes (4800:24=200), each superframe consisting of the transmission of 15 orthogonally Walsh-modulated channel symbols. At a speed of 2400 symbols/s, each 200 ms superframe corresponds to a length of 480 tribit symbols or 1440 bits (15 channel symbols × 32 Walsh chips = 480).
| Figure 5a: MS-110A frame structure (Preamble, interleaved data, EOM & Flush), showing how the preamble is composed of superframes (SF1...SFm). |
| Figure 5b: ACF of the sync preamble: peaks recurring at ~200 ms (dT = 200.609 ms) confirm the STANAG-4415/MS-110A sync pattern over the 4.8 s long-interleave preamble (dT = 4.799999 s). |
| Figure 5c: Initial section (preamble) of the bitstream showing the 1440-bit frame width across 24 superframes. |
The waveform following the preamble (the data segment) still shows strong periodic peaks at 66.67 ms intervals, corresponding to 160 over-the-air symbols, see Figure 6. This is because MS-110A scrambles the data symbols against a pseudo-randomized sequence that produces a periodic pattern of 160 transmit symbols in length (as per MS-110A §5.3.2.3.8).
| Figure 6: ACF of the data segment following the preamble, showing periodic peaks at 66.67 ms (160 symbols). |
The demodulated bitstream shown in Figure 7 displays high-entropy data with no discernible periodicity or autocorrelation peaks, and shows no repetitive patterns such as Initialization Vectors or series of reversals. The statistical analysis (Figure 8) confirms this assessment: a balanced bit distribution (50/50), a relatively flat byte histogram, and near-zero autocorrelation across all tested lags, yielding an overall score of 5/6 — consistent with encrypted or well-scrambled data. This should not be confused with the periodic ACF peaks noted in Section 2.1 Figure 6: those stem entirely from the standard's own known data-scrambling sequence — applied uniformly regardless of payload content — and are removed during proper demodulation, unlike the analysis here, which targets the fully descrambled, actual user payload.
| Figure 7: Demodulated MS-110A 75 bps bitstream showing no visible framing patterns or periodicity. |
| Figure 8: Statistical analysis of a demodulated bitstream. |
Figure 9a shows the signal geolocation results obtained using the TDoA (Time Difference of Arrival) method across clusters of KiwiSDR receivers. The elongated solution ellipses place the source along a line running from Cyprus into southern Turkey. Taking the map overlays at face value, the fix is consistent with, but does not uniquely pinpoint, the northeastern portion of Cyprus known as TRNC (Turkish Republic of Northern Cyprus)(2); the same geometry is equally consistent with a source on the adjacent Turkish mainland coast.
![]() |
| Figure 9a: TDoA geolocation results across KiwiSDR clusters targeting Cyprus area. |
Since the Akrotiri UK DHFCS (Defence High Frequency Communications Service) facility in Cyprus — and specifically its Salt Lake transmitter site (3) — is widely recognized and well known within the utility/SIGINT community, HF transmissions geolocated to Cyprus are almost automatically attributed to this site. Figure 9b shows exactly the kind of installation behind that reputation: a satellite view of the Salt Lake site itself, its CDAA-type circular antenna arrays clearly visible on the ground.
![]() |
| Figure 9b: Satellite view of the DHFCS Salt Lake transmitter site, showing several circular antenna arrays (CDAA-type) consistent with a major HF installation. Source: Google Earth. |
## 4.1 But what if it's not UK DHFCS?
The presence of military communications infrastructure beyond Akrotiri, in the Turkish-administered sector of Cyprus, is not just easily imaginable — it is a matter of public record too. Wikipedia's own entry on the Security Forces Command (GKK)(4) [2], the TRNC's military and security force, also publicly documents its organizational structure, which includes a dedicated Communications & IT Command (Figure 10).
| Figure 10: GKK organizational chart; highlight added to indicate the Communications & IT Command. Source: Wikipedia. |
Still, this general picture opens the door to an alternative attribution: a Turkish-operated transmitter site, even if one that cannot be pinned down to a specific, named installation.
It's a purely personal hypothesis, admittedly one that may seem far-fetched or even provocative — but it is supported, in my opinion, by the following points.
Although the DHFCS HF band plan is not publicly disclosed, technical and operational needs undoubtedly require DHFCS to use multiple frequencies simultaneously. These concurrent frequencies can, in principle, originate from a single transmitter site (5). An example is shown in Figure 11, where a DHFCS-consistent STANAG-4285 fleet broadcast at 1200 bps (20123.2 kHz) is captured alongside a separate STANAG-4415/MS-110A signal at 75 bps (18503.0 kHz, the signal being analyzed). Note that the captures below merely illustrate concurrent HF activity observed, not a common point of origin.
| Figure 11: Concurrent HF activity captured from Cyprus area (both geolocated) on two different KiwiSDRs. |
![]() |
| Figure 12: Waterfall display over an observation timeframe. |
Attentive readers may have noticed a discrepancy in fading profiles between the two signals in Figure 12 (bottom). It is worth noting that this, on its own, does not prove distinct transmitter sites: due to frequency-selective fading and the limited coherence bandwidth of the ionospheric channel, two signals separated by a few tens of kHz can exhibit completely uncorrelated fading dynamics even when originating from the exact same facility — or even the same antenna array. The relative strength difference between the two signals, however, has at times been observed to persist for several minutes — longer than the coherence time typical of fast ionospheric fading (on the order of seconds). This points to slower-scale propagation variability, or simply a genuine difference in transmit power between the two services, rather than fast fading — and, again, does not by itself indicate separate transmitter sites.
"18503.0 : UK DHFCS-AKROTIRI, GBR, USB, MIL-STD-188-110A (11AUG25 1653) (F1GOC)"
(courtesy of UDXF Group)
Filtering the same logs by frequency (18503), only one further entry emerged alongside the ones above, relating to an unspecified STANAG-4285 transmission on 18503.2 kHz, logged on 8 May 2026:
"18503.2 : UNID, STANAG 4285 (08MAY26) (WO)"
(courtesy of UDXF Group)
Note that unlike the two entries above, this log carries no technical parameters (baud rate, ACF, or similar) to substantiate the waveform call — it is markedly sparser, raising the possibility of an aural (by-ear) identification rather than one backed by actual demodulation with the help of commonly used decoders (Sorcerer, Multipsk, Sigmira, Code300,...). For what it's worth, in my own monitoring of 18503 kHz — admittedly not exhaustive — I have not detected any STANAG-4285 activity on that specific frequency as of this writing (which could hint at a possible misidentification by the WO observer).
Regarding the type of encryption used, I cross-referenced the 75 bps demodulated bitstream against known synchronization sequences — such as those for KG-84 or KW-46, commonly used within NATO for fleet broadcasts — but found no matches. Assuming encryption is indeed present, it likely employs a different or non-standard/proprietary cipher.
As it happens, I reached the same negative results — no recognizable, well-known encryption signature — when examining DHFCS's 1536-bit bitstreams. However, in the case being analyzed the negative result carries considerably more weight:
a) the demodulated 75 bps stream is a single, well-defined user data bitstream, applied directly to the HF modem after the cipher engine.
b) DHFCS's demodulated 1536-bit bitstreams are formed by multiplexing n-channels at the input ports of the multiplexer (DRS GA-205 TDM); since the algorithm governing the multiplexer is unknown, it's impossible to correctly reconstruct the individual per-channel bitstreams.
Thus, a negative result there is far less conclusive, since it simply reflects a raw demodulation of the multiplexer output — i.e., it's a "failed" demultiplexing rather than a genuine absence of known synchronization patterns.
It's tempting to speculate that opting for an indigenous, non-NATO cipher might serve a further purpose: shielding this traffic even from the SIGINT facilities hosted within the nearby British Sovereign Base Areas of Akrotiri and Dhekelia. HF skip propagation means physical proximity is no strict prerequisite for interception, but a same-island transmitter would still offer those facilities an unusually short, high-quality intercept path — making a domestic cipher a sensible extra safeguard, even among nominal NATO allies.
## 5. Conclusions
Taken together, the elements discussed above point toward the possibility of a second, Turkish-operated transmitter site sharing the Cyprus/southern-Turkey HF environment, rather than a DHFCS Akrotiri origin, as the source of the 18503.0 kHz traffic. To summarize, this working hypothesis rests on:
a) an atypical waveform choice (75 bps STANAG-4415/MS-110A) for a site whose UDXF-documented profile is dominated by 1200 bps STANAG-4285;
b) the absence of any recognizable NATO cryptographic framing structure in the demodulated bitstream — a stronger indicator than entropy analysis alone, and one reinforced by the fact that the 75 bps stream, unlike DHFCS's multiplexed TDM output, is a single well-defined bitstream where a negative result actually carries weight;
c) a TDoA bearing consistent with the TRNC area, though not uniquely so;
d) the existence of a documented, indigenous Turkish military crypto program (ASELSAN/TÜBİTAK MİLSEC family) capable of explaining the negative crypto match;
e) publicly documented Turkish military communications infrastructure in the TRNC, including the GKK's own Communications & IT Command.
Continued monitoring of 18503.0 kHz — together with further TDoA passes and, ideally, independent corroboration of the anomalous STANAG-4285 log entry — should help either strengthen or falsify this hypothesis over time. None of this amounts to proof, and I hold this hypothesis loosely. If you have documented information, direct monitoring experience, or technical arguments that support, refine, or contradict it, I'd genuinely welcome hearing from you — constructive criticism, backed by evidence, is exactly what a case like this needs.
3. In the Western Sovereign Base Area of Cyprus, DHFCS sites include the Salt Lake transmitter (34°36'50"N 32°56'12"E), near Akrotiri, and the Episkopi receiver (34°40'47"N 32°51'24"E), roughly 13 km to the west. Positioned in the eastern Mediterranean, these installations facilitate communications for UK and NATO forces in the Middle East and beyond, enhancing resilience in a key geopolitical theater.
4. The GKK integrates units for tactical communications (HF/VHF/UHF), data encryption, and electronic warfare, part of the wider C4ISR network across Northern Cyprus. Connectivity to the mainland is presumably provided by TAFICS, Turkey's own military communications backbone [9] — which also relies on TÜBİTAK-supplied cryptography, consistent with the indigenous crypto capability discussed in Section 4.2.
5. In military HF operations, the concurrent use of a high-throughput waveform alongside a low-rate, robust-mode waveform for degraded channels or high-priority traffic is common practice, and both can originate from the same transmitter. Modern station architectures employ matrix switches to route multiple HF modems to separate, concurrently active transmitters/antennas, or digitally synthesized exciters generating independent I/Q streams combined at IF/RF. Consequently, simultaneous, multi-frequency dual-waveform operation from a single facility is architecturally unremarkable on its own.
6. UDXF stands for Utility DXers Forum, an online community of radio enthusiasts monitoring non-broadcast HF stations below 30 MHz — including military, maritime, aeronautical, and other "utility" signals, as opposed to broadcasting, pirate, or amateur radio traffic. Active since 2006, it maintains a mailing list through which members exchange logs and technical observations.
[2] https://en.wikipedia.org/wiki/Security_Forces_Command
[3] https://www.thenationalherald.com/.../
[4] https://simerini.sigmalive.com/article/2025/9/21/.../
[5] https://udxf.nl/
[6] https://www.mythicsoft.com/agentransack/
[7] https://www.hurriyet.com.tr/gundem/...
[8] https://en.bilgem.tubitak.gov.tr/en/institutional/
[9] https://tskgv.org.tr/savunmasanayiigundem/tsk-ku-bant-uydu-muhabere-sistemi-projesi





No comments:
Post a Comment