Cyprus has long been synonymous, in the utility monitoring community, with a single name: Akrotiri (DHFCS/RAF). The island's dense HF military traffic tends to get filed under that one well-documented facility almost by reflex — and for good reason, given how thoroughly its fingerprint has been logged over the years. This post starts from an unusual waveform intercepted on 18503.0 kHz that doesn't quite fit that story.
 |
| 18503.0 kHz/USB — the signal at the center of this investigation |
What follows is an attempt to characterize it properly, before eventually asking a question that felt worth asking: what if, this time, it isn't Akrotiri at all?
A note on the post structure: Sections 1 through 3 are essentially about establishing what this signal actually is — confirming its identity as a 75 bps STANAG-4415/MS-110A waveform, down to the preamble structure, the lack of mini-probes, and its cryptographic fingerprint. If you're here mainly for the "who's transmitting" question, Section 4 is where that discussion happens, and you're welcome to jump ahead. But that identification work is what turns the final hypothesis into something more than a guess — so if you have the patience for it, it's worth the detour.
Fair warning: the technical analysis is solid, but the attribution that follows it is a personal hypothesis, offered for what it's worth — and, as always, open to correction.
Transmission received on 18503.0 kHz/USB, first logged by me on 19 August 2026, and monitored regularly, though not continuously, since. Although the transmission looks, to the naked eye on the waterfall, like a classic STANAG-4285 fleet broadcast, its "sound" and subsequent analysis reveal a serial waveform of the MS-110A type operating in 75 bps Long Interleaver mode — a rather unusual configuration that prompted a closer look. Captures, recordings, and waterfall screenshots thanks to the KiwiSDR receivers kindly shared by my friend Linkz [1].
Notably, the transmission scheme is not a typical 24/7 active fleet broadcast; instead, it alternates between "off" states and active periods (for either short or extended periods). The transmissions start "out of the blue", without prior ALE sounding or handshake calls. This points either to scheduled transmission windows (though not strictly starting on the hour or half-hour) or to receivers parked on the listening frequency (18503.0 kHz).
In this regard, I have repeatedly noticed transmissions beginning in the morning around 06:50 UTC, lasting just a few minutes (recordings available in the Downloads section at the bottom of the post). I cannot confirm this to be a fixed daily start time, but such repetition seems unlikely to be mere coincidence.
Transmissions may consist of isolated single messages or extended continuous streams containing multiple messages — which are not necessarily contiguous. In the latter case, individual messages within the stream remain identifiable by their distinct preambles, which likely serve to trigger or re-synchronize waiting receivers. This behavior is otherwise consistent with NATO broadcast protocols.
## 1. Waveform analysis and confirmation
Figure 1 shows the initial SA (Signals Analyzer) demodulator lock on the intercepted signal: a carrier at 1801.29 Hz (USB, +1801.4 Hz offset), a symbol rate of ~2400.22–2400.33 Bd, and an 8-ary constellation — all consistent with the 2400 Bd, 8-PSK tribit-symbol architecture shared across the MS-110A serial-tone family.
The decoding software used correctly classifies the signal as MS-110A, tagging it "110A/75L" — i.e. the 75 bps mode with the long interleave setting. It's worth noting, however, that at the waveform level this 75 bps mode is identical to STANAG-4415's NATO Robust Waveform — same DSSS (Direct Sequence Spread Spectrum)(1) Walsh modulation, same fixed 2400 Bd symbol rate — so for logging purposes labeling the signal definitively as "MS-110A" or "STANAG-4415" from its RF fingerprint alone isn't strictly accurate.
 |
| Figure 1: Signal acquisition and demodulator lock; arrow marks the preamble at the start of a new message. |
## 1.1 STANAG-4415 and MS-110A
As mentioned, at the waveform level STANAG-4415 and MS-110A are the same signal and fully interoperable, but STANAG-4415 layers stricter performance/conformance requirements on top of what MS-110A specifies natively. MS-110A is a broad US standard covering an entire family of serial- and parallel-tone HF modem waveforms; the 75 bps robust mode is just one entry in that family. STANAG-4415, by contrast, is a narrowly-scoped NATO standard dedicated only to that robust 75 bps mode.
The relationship got formalized over time: MS-110B (dated 2000) §5.3.1.3.h explicitly lists the robust 75 bps mode as an optional mode, stating it "shall be in accordance with STANAG 4415" — i.e., in the newer US MIL-STDs (110B, 110C, 110D), the robust 75 bps entry is defined by reference to STANAG-4415 rather than re-specified in-house, whereas 110A originally carried its own native 75 bps definition before this harmonization. As per MS-110B (dated 2000) §5.3.4: "The optional robust serial tone mode shall employ the waveform specified above for 75 bps operation, and shall meet the performance requirements of STANAG 4415".
As mentioned, at the waveform level STANAG-4415 and MS-110A are the same signal and fully interoperable, but STANAG-4415 layers stricter performance/conformance requirements on top of what MS-110A specifies natively. MS-110A is a broad US standard covering an entire family of serial- and parallel-tone HF modem waveforms; the 75 bps robust mode is just one entry in that family. STANAG-4415, by contrast, is a narrowly-scoped NATO standard dedicated only to that robust 75 bps mode.
The relationship got formalized over time: MS-110B (dated 2000) §5.3.1.3.h explicitly lists the robust 75 bps mode as an optional mode, stating it "shall be in accordance with STANAG 4415" — i.e., in the newer US MIL-STDs (110B, 110C, 110D), the robust 75 bps entry is defined by reference to STANAG-4415 rather than re-specified in-house, whereas 110A originally carried its own native 75 bps definition before this harmonization. As per MS-110B (dated 2000) §5.3.4: "The optional robust serial tone mode shall employ the waveform specified above for 75 bps operation, and shall meet the performance requirements of STANAG 4415".
Thus, if you're seeing a 75 bps DSSS-Walsh burst at 2400 Bd, you generally can't distinguish "it's STANAG-4415" from "it's the MS-110A 75 bps mode" from the RF signature alone — they're the same waveform. The distinction only really matters for conformance testing/interoperability certification, not for what hits your receiver.
Where the difference actually exists is on the receiver design side, not the bitstream side: a modem built to fully meet the STANAG-4415 spec will have a receiver capable of decoding at much lower SNR (down to roughly -9/-11 dB in 3kHz AWGN) than a receiver that only implements the baseline MIL-STD-188-110A target — but this is a performance difference, measurable only through comparative lab testing (BER vs SNR/multipath/Doppler), not something the modem can read or infer from a single intercepted burst.
Where the difference actually exists is on the receiver design side, not the bitstream side: a modem built to fully meet the STANAG-4415 spec will have a receiver capable of decoding at much lower SNR (down to roughly -9/-11 dB in 3kHz AWGN) than a receiver that only implements the baseline MIL-STD-188-110A target — but this is a performance difference, measurable only through comparative lab testing (BER vs SNR/multipath/Doppler), not something the modem can read or infer from a single intercepted burst.
The L3Harris RF-5710A, a military-grade modem, demodulates either waveform interchangeably (Figure 2), as this essentially comes down to a different front-panel label on the modem.
 |
| Figure 2: Harris RF-5710A front panels displaying the two equivalent modulation settings: STANAG-4415 (top) and SERIAL MS-110 mode (bottom). |
## 1.2 Lack of miniprobes
Neither STANAG-4415 nor the MS-110A 75 bps mode uses mini-probes. Mini-probes (periodic resync sequences) only appear in serial-tone waveforms with 150–4800 bps rates (Figure 3a), needed there because long burst duration allows channel drift between preamble and end-of-transmission. 75 bps mode doesn't need it: DSSS Walsh spreading at fixed 2400 Bd is inherently redundant per bit, so channel tracking/noise immunity comes from the spreading itself, not periodic re-training. Thus, a single preamble without mid-stream mini-probes cannot support late-entry acquisition, further justifying the above hypothesis of parked receivers standing by on a pre-assigned frequency.
Neither STANAG-4415 nor the MS-110A 75 bps mode uses mini-probes. Mini-probes (periodic resync sequences) only appear in serial-tone waveforms with 150–4800 bps rates (Figure 3a), needed there because long burst duration allows channel drift between preamble and end-of-transmission. 75 bps mode doesn't need it: DSSS Walsh spreading at fixed 2400 Bd is inherently redundant per bit, so channel tracking/noise immunity comes from the spreading itself, not periodic re-training. Thus, a single preamble without mid-stream mini-probes cannot support late-entry acquisition, further justifying the above hypothesis of parked receivers standing by on a pre-assigned frequency.
 |
| Figure 3a: MIL-STD-188-110A, Table XIX: the 75 bps row shows 0 known symbols, confirming the absence of mini-probes at this rate. |
Figure 3b (adapted from STANAG-4415, Figure 2.1) illustrates the 75 bps modem architecture, showing SW1, SW2, and SW3 across the two operational phases. SW2 and SW3 switch between position "b" (synchronization preamble phase) and position "a" (data phase) — with no third state available for either. SW1, by contrast, remains in the same "input data" position throughout both phases: since the preamble and each Interleave Block share the same duration, the interleaver is continuously pre-loaded with incoming input data even while the preamble itself is being transmitted, ensuring the data phase can begin without delay once the preamble ends. No third switch state exists for SW2/SW3: once transmission moves to the data phase, the Preamble Generator and Sync-mode PN Generator are permanently disengaged, with no provision for reintroducing an intermediate re-synchronization ("probe") sequence — consistent with the absence of mini-probes discussed above.
 |
| Figure 3b: 75 bps modem architecture — SW2/SW3 switching between "b" (sync preamble) and "a" (data phase), while SW1 remains fixed, continuously pre-loading the interleaver with input data throughout both phases. |
## 1.3 Walsh modulation
Although the use of Walsh modulation is formally specified in the reference standards (STANAG-4415 and MS-110A), its presence can be directly verified through carrier regeneration via the squarer/m-th power loop technique implemented in SA.
The presence of a clean spectral line at exponent n=2 in the non-linear analysis (Figure 4, center) provides mathematical proof that the preamble carries an underlying BPSK-type modulation associated to Walsh chips. Squaring a two-state structure (0°/180°) collapses the phase, producing a single coherent line. With exponent n=8 (Figure 4, bottom) this spectral line vanishes completely across both preamble and data sections, confirming that the underlying signal is a masked BPSK rather than a native 8-PSK modulation.
Although the data payload also employs BPSK-mapped Walsh modulation followed by 8-PSK scrambling, the spectral line at n=2 is confined to the preamble. This is because the preamble uses a fixed, highly repetitive PN synchronization sequence; the combination of BPSK phase symmetry and strict structural periodicity concentrates the squared energy into a discrete peak. Conversely, the data payload transmits high-entropy user data.
While squaring (n=2) mathematically removes the BPSK phase transitions from individual Walsh chips, the non-repetitive, pseudo-random nature of the payload (further randomized by interleaving) spreads the energy evenly across the bandwidth, dissolving the discrete tone into the spectral noise floor.
Although the use of Walsh modulation is formally specified in the reference standards (STANAG-4415 and MS-110A), its presence can be directly verified through carrier regeneration via the squarer/m-th power loop technique implemented in SA.
The presence of a clean spectral line at exponent n=2 in the non-linear analysis (Figure 4, center) provides mathematical proof that the preamble carries an underlying BPSK-type modulation associated to Walsh chips. Squaring a two-state structure (0°/180°) collapses the phase, producing a single coherent line. With exponent n=8 (Figure 4, bottom) this spectral line vanishes completely across both preamble and data sections, confirming that the underlying signal is a masked BPSK rather than a native 8-PSK modulation.
Although the data payload also employs BPSK-mapped Walsh modulation followed by 8-PSK scrambling, the spectral line at n=2 is confined to the preamble. This is because the preamble uses a fixed, highly repetitive PN synchronization sequence; the combination of BPSK phase symmetry and strict structural periodicity concentrates the squared energy into a discrete peak. Conversely, the data payload transmits high-entropy user data.
While squaring (n=2) mathematically removes the BPSK phase transitions from individual Walsh chips, the non-repetitive, pseudo-random nature of the payload (further randomized by interleaving) spreads the energy evenly across the bandwidth, dissolving the discrete tone into the spectral noise floor.
 |
| Figure 4: Top: Original signal spectrogram highlighting the preamble region. Center (n=2): Carrier regeneration revealing a sharp spectral line confined to the preamble, proving the underlying BPSK-type modulation. Bottom (n=8): Complete absence of the spectral line across preamble and data payload, confirming a BPSK base waveform rather than a native 8-PSK constellation |
## 2. Preamble structure and ACF analysis
As per MS-110A §5.3.2.3.7.2.1 "The synchronization pattern shall consist of either three or twenty four superframes (depending on whether either zero, short, or long interleave periods are used)", as illustrated in Figure 5a. It is possible to analyze the initial synchronization preamble preceding the data (Figure 5b).
The 200 ms ACF value is compliant with the sync pattern of MS-110A. The 4.8 s length of the sync preamble indicates the long interleaver setting with its 24 superframes (4800:24=200), each superframe consisting of the transmission of 15 orthogonally Walsh-modulated channel symbols. At a speed of 2400 symbols/s, each 200 ms superframe corresponds to a length of 480 tribit symbols or 1440 bits (15 channel symbols × 32 Walsh chips = 480).
As per MS-110A §5.3.2.3.7.2.1 "The synchronization pattern shall consist of either three or twenty four superframes (depending on whether either zero, short, or long interleave periods are used)", as illustrated in Figure 5a. It is possible to analyze the initial synchronization preamble preceding the data (Figure 5b).
The 200 ms ACF value is compliant with the sync pattern of MS-110A. The 4.8 s length of the sync preamble indicates the long interleaver setting with its 24 superframes (4800:24=200), each superframe consisting of the transmission of 15 orthogonally Walsh-modulated channel symbols. At a speed of 2400 symbols/s, each 200 ms superframe corresponds to a length of 480 tribit symbols or 1440 bits (15 channel symbols × 32 Walsh chips = 480).
 |
| Figure 5a: MS-110A frame structure (Preamble, interleaved data, EOM & Flush), showing how the preamble is composed of superframes (SF1...SFm). |
 |
| Figure 5b: ACF of the sync preamble: peaks recurring at ~200 ms (dT = 200.609 ms) confirm the STANAG-4415/MS-110A sync pattern over the 4.8 s long-interleave preamble (dT = 4.799999 s). |
Figure 5c shows the bitstream resulting from 8-PSK demodulation of the over-the-air symbols (truncated initially for space and visual clarity). Note the expected length of the highlighted preamble section: 1440 bits (480 tribit symbols) across 24 superframes.
 |
| Figure 5c: Initial section (preamble) of the bitstream showing the 1440-bit frame width across 24 superframes. |
## 2.1 Data block ACF analysis
The waveform following the preamble (the data segment) still shows strong periodic peaks at 66.67 ms intervals, corresponding to 160 over-the-air symbols, see Figure 6. This is because MS-110A scrambles the data symbols against a pseudo-randomized sequence that produces a periodic pattern of 160 transmit symbols in length (as per MS-110A §5.3.2.3.8).
The waveform following the preamble (the data segment) still shows strong periodic peaks at 66.67 ms intervals, corresponding to 160 over-the-air symbols, see Figure 6. This is because MS-110A scrambles the data symbols against a pseudo-randomized sequence that produces a periodic pattern of 160 transmit symbols in length (as per MS-110A §5.3.2.3.8).
 |
| Figure 6: ACF of the data segment following the preamble, showing periodic peaks at 66.67 ms (160 symbols). |
## 3. Analysis of a demodulated bitstream
The demodulated bitstream shown in Figure 7 displays high-entropy data with no discernible periodicity or autocorrelation peaks, and shows no repetitive patterns such as Initialization Vectors or series of reversals. The statistical analysis (Figure 8) confirms this assessment: a balanced bit distribution (50/50), a relatively flat byte histogram, and near-zero autocorrelation across all tested lags, yielding an overall score of 5/6 — consistent with encrypted or well-scrambled data. This should not be confused with the periodic ACF peaks noted in Section 2.1 Figure 6: those stem entirely from the standard's own known data-scrambling sequence — applied uniformly regardless of payload content — and are removed during proper demodulation, unlike the analysis here, which targets the fully descrambled, actual user payload.
The demodulated bitstream shown in Figure 7 displays high-entropy data with no discernible periodicity or autocorrelation peaks, and shows no repetitive patterns such as Initialization Vectors or series of reversals. The statistical analysis (Figure 8) confirms this assessment: a balanced bit distribution (50/50), a relatively flat byte histogram, and near-zero autocorrelation across all tested lags, yielding an overall score of 5/6 — consistent with encrypted or well-scrambled data. This should not be confused with the periodic ACF peaks noted in Section 2.1 Figure 6: those stem entirely from the standard's own known data-scrambling sequence — applied uniformly regardless of payload content — and are removed during proper demodulation, unlike the analysis here, which targets the fully descrambled, actual user payload.
 |
| Figure 7: Demodulated MS-110A 75 bps bitstream showing no visible framing patterns or periodicity. |
 |
| Figure 8: Statistical analysis of a demodulated bitstream. |
## 4. Geolocation and hypothesis on the source
Figure 9a shows the signal geolocation results obtained using the TDoA (Time Difference of Arrival) method across clusters of KiwiSDR receivers. The elongated solution ellipses place the source along a line running from Cyprus into southern Turkey. Taking the map overlays at face value, the fix is consistent with, but does not uniquely pinpoint, the northeastern portion of Cyprus known as TRNC (Turkish Republic of Northern Cyprus)(2); the same geometry is equally consistent with a source on the adjacent Turkish mainland coast.
Figure 9a shows the signal geolocation results obtained using the TDoA (Time Difference of Arrival) method across clusters of KiwiSDR receivers. The elongated solution ellipses place the source along a line running from Cyprus into southern Turkey. Taking the map overlays at face value, the fix is consistent with, but does not uniquely pinpoint, the northeastern portion of Cyprus known as TRNC (Turkish Republic of Northern Cyprus)(2); the same geometry is equally consistent with a source on the adjacent Turkish mainland coast.
 |
| Figure 9a: TDoA geolocation results across KiwiSDR clusters targeting Cyprus area. |
Since the Akrotiri UK DHFCS (Defence High Frequency Communications Service) facility in Cyprus — and specifically its Salt Lake transmitter site (3) — is widely recognized and well known within the utility/SIGINT community, HF transmissions geolocated to Cyprus are almost automatically attributed to this site. Figure 9b shows exactly the kind of installation behind that reputation: a satellite view of the Salt Lake site itself, its CDAA-type circular antenna arrays clearly visible on the ground.
 |
| Figure 9b: Satellite view of the DHFCS Salt Lake transmitter site, showing several circular antenna arrays (CDAA-type) consistent with a major HF installation. Source: Google Earth. |
## 4.1 But what if it's not UK DHFCS?
The presence of military communications infrastructure beyond Akrotiri, in the Turkish-administered sector of Cyprus, is not just easily imaginable — it is a matter of public record too. Wikipedia's own entry on the Security Forces Command (GKK)(4) [2], the TRNC's military and security force, also publicly documents its organizational structure, which includes a dedicated Communications & IT Command (Figure 10).
 |
| Figure 10: GKK organizational chart; highlight added to indicate the Communications & IT Command. Source: Wikipedia. |
Naval infrastructure adds a further, more concrete data point: as of late 2025, Cypriot press reports indicate that Turkish warships are now permanently stationed at Famagusta, alongside separate naval base works reportedly under way at Bogazi and a vessel traffic monitoring system [3] — reportedly involving several dedicated stations — being installed in the Karpasia area. None of these reports specifically confirm HF transmission capability, but the EW/radar installations reported in the Pentadaktylos range [4] are exactly the kind of electronic infrastructure that could plausibly include HF communication capability — reinforcing the general picture of an expanding, communications-dependent military footprint in the TRNC's eastern coastal area, geographically consistent with the TDoA bearing discussed above.
It should be noted, however, that open-source documentation of this kind rarely goes beyond such general, high-level information: precise, named confirmation of specific HF transmitter sites — let alone their operational role — remains historically scarce, even by ordinary OSINT standards.
Still, this general picture opens the door to an alternative attribution: a Turkish-operated transmitter site, even if one that cannot be pinned down to a specific, named installation.
It's a purely personal hypothesis, admittedly one that may seem far-fetched or even provocative — but it is supported, in my opinion, by the following points.
Still, this general picture opens the door to an alternative attribution: a Turkish-operated transmitter site, even if one that cannot be pinned down to a specific, named installation.
It's a purely personal hypothesis, admittedly one that may seem far-fetched or even provocative — but it is supported, in my opinion, by the following points.
## 4.2 The used Waveforms
Although the DHFCS HF band plan is not publicly disclosed, technical and operational needs undoubtedly require DHFCS to use multiple frequencies simultaneously. These concurrent frequencies can, in principle, originate from a single transmitter site (5). An example is shown in Figure 11, where a DHFCS-consistent STANAG-4285 fleet broadcast at 1200 bps (20123.2 kHz) is captured alongside a separate STANAG-4415/MS-110A signal at 75 bps (18503.0 kHz, the signal being analyzed). Note that the captures below merely illustrate concurrent HF activity observed, not a common point of origin.
Although the DHFCS HF band plan is not publicly disclosed, technical and operational needs undoubtedly require DHFCS to use multiple frequencies simultaneously. These concurrent frequencies can, in principle, originate from a single transmitter site (5). An example is shown in Figure 11, where a DHFCS-consistent STANAG-4285 fleet broadcast at 1200 bps (20123.2 kHz) is captured alongside a separate STANAG-4415/MS-110A signal at 75 bps (18503.0 kHz, the signal being analyzed). Note that the captures below merely illustrate concurrent HF activity observed, not a common point of origin.
 |
| Figure 11: Concurrent HF activity captured from Cyprus area (both geolocated) on two different KiwiSDRs. |
As shown in Figure 12, the upper capture (24 August 2026, 17:04 UTC) shows an active STANAG-4285 1200 bps/L transmission (1536-bit TDM frames) on 18534.20 kHz, while the 18503.0 kHz channel — associated with the 75 bps/L serial signal — is inactive. The lower capture (25 August 2026, 11:20 UTC, ~18 hours later) shows both the 75 bps/L serial and the STANAG-4285 1200 bps/L transmissions active simultaneously. Both captures are geolocated to the Cyprus area.
 |
| Figure 12: Waterfall display over an observation timeframe. |
It must be noted that the 1200 bps STANAG-4285 signals match DHFCS's well-documented fingerprint, while the 75 bps STANAG-4415/MS-110A signal is atypical for that profile. My hypothesis here is that the two waveforms could originate from two distinct stations on the same island/area rather than a single site — namely the well-known DHFCS site, and perhaps a Turkish-operated site. As above, neither band plans nor transmitter locations are publicly disclosed by Turkish military or other civil authorities.
Attentive readers may have noticed a discrepancy in fading profiles between the two signals in Figure 12 (bottom). It is worth noting that this, on its own, does not prove distinct transmitter sites: due to frequency-selective fading and the limited coherence bandwidth of the ionospheric channel, two signals separated by a few tens of kHz can exhibit completely uncorrelated fading dynamics even when originating from the exact same facility — or even the same antenna array. The relative strength difference between the two signals, however, has at times been observed to persist for several minutes — longer than the coherence time typical of fast ionospheric fading (on the order of seconds). This points to slower-scale propagation variability, or simply a genuine difference in transmit power between the two services, rather than fast fading — and, again, does not by itself indicate separate transmitter sites.
Attentive readers may have noticed a discrepancy in fading profiles between the two signals in Figure 12 (bottom). It is worth noting that this, on its own, does not prove distinct transmitter sites: due to frequency-selective fading and the limited coherence bandwidth of the ionospheric channel, two signals separated by a few tens of kHz can exhibit completely uncorrelated fading dynamics even when originating from the exact same facility — or even the same antenna array. The relative strength difference between the two signals, however, has at times been observed to persist for several minutes — longer than the coherence time typical of fast ionospheric fading (on the order of seconds). This points to slower-scale propagation variability, or simply a genuine difference in transmit power between the two services, rather than fast fading — and, again, does not by itself indicate separate transmitter sites.
Turning back to the waveforms, I processed the UDXF(6)[5] logs from 2006 to date (currently more than 300K log entries), using Agent Ransack — a file searching tool from Mythicsoft [6] — and filtering for the term "Akrotiri" (case-insensitive). After excluding entries relating to MS-141A ALE soundings, wx/sitrep, 4-tone FSK, GMDSS/DSC, OTHR "Pluto" (and similar), the remaining logs exclusively report the use of the STANAG-4285 waveform, in either 600 or 1200 bps mode. Only two log entries, both from the same observer (F1GOC), report a MS-110A transmission, intercepted on 18503.0 kHz on 11 August 2025, though not identified with certainty by the analysis software:
"18503 : UNID (UK MIL DHFCS AKROTIRI?) MIL-STD-188-110A 2400BD, PSK-8, ACF 66 MS/160 BITS. HOWEVER, K500 DOES NOT RECOGNIZE IT. I FOUND NOTHING ON THE NET FOR THIS FREQUENCY. (F1GOC)"
"18503.0 : UK DHFCS-AKROTIRI, GBR, USB, MIL-STD-188-110A (11AUG25 1653) (F1GOC)"
(courtesy of UDXF Group)
Filtering the same logs by frequency (18503), only one further entry emerged alongside the ones above, relating to an unspecified STANAG-4285 transmission on 18503.2 kHz, logged on 8 May 2026:
"18503.2 : UNID, STANAG 4285 (08MAY26) (WO)"
(courtesy of UDXF Group)
Note that unlike the two entries above, this log carries no technical parameters (baud rate, ACF, or similar) to substantiate the waveform call — it is markedly sparser, raising the possibility of an aural (by-ear) identification rather than one backed by actual demodulation with the help of commonly used decoders (Sorcerer, Multipsk, Sigmira, Code300,...). For what it's worth, in my own monitoring of 18503 kHz — admittedly not exhaustive — I have not detected any STANAG-4285 activity on that specific frequency as of this writing (which could hint at a possible misidentification by the WO observer).
"18503.0 : UK DHFCS-AKROTIRI, GBR, USB, MIL-STD-188-110A (11AUG25 1653) (F1GOC)"
(courtesy of UDXF Group)
Filtering the same logs by frequency (18503), only one further entry emerged alongside the ones above, relating to an unspecified STANAG-4285 transmission on 18503.2 kHz, logged on 8 May 2026:
"18503.2 : UNID, STANAG 4285 (08MAY26) (WO)"
(courtesy of UDXF Group)
Note that unlike the two entries above, this log carries no technical parameters (baud rate, ACF, or similar) to substantiate the waveform call — it is markedly sparser, raising the possibility of an aural (by-ear) identification rather than one backed by actual demodulation with the help of commonly used decoders (Sorcerer, Multipsk, Sigmira, Code300,...). For what it's worth, in my own monitoring of 18503 kHz — admittedly not exhaustive — I have not detected any STANAG-4285 activity on that specific frequency as of this writing (which could hint at a possible misidentification by the WO observer).
It should be stressed that the considerations above rest solely on the UDXF archives — a very large database, admittedly, but a single source nonetheless — and do not necessarily amount to a smoking gun. Combined with the direction-finding results, however, they can reasonably be said to support my hypothesis put forward here.
## 4.3 The used encryption
Regarding the type of encryption used, I cross-referenced the 75 bps demodulated bitstream against known synchronization sequences — such as those for KG-84 or KW-46, commonly used within NATO for fleet broadcasts — but found no matches. Assuming encryption is indeed present, it likely employs a different or non-standard/proprietary cipher.
As it happens, I reached the same negative results — no recognizable, well-known encryption signature — when examining DHFCS's 1536-bit bitstreams. However, in the case being analyzed the negative result carries considerably more weight:
a) the demodulated 75 bps stream is a single, well-defined user data bitstream, applied directly to the HF modem after the cipher engine.
b) DHFCS's demodulated 1536-bit bitstreams are formed by multiplexing n-channels at the input ports of the multiplexer (DRS GA-205 TDM); since the algorithm governing the multiplexer is unknown, it's impossible to correctly reconstruct the individual per-channel bitstreams.
Thus, a negative result there is far less conclusive, since it simply reflects a raw demodulation of the multiplexer output — i.e., it's a "failed" demultiplexing rather than a genuine absence of known synchronization patterns.
Regarding the type of encryption used, I cross-referenced the 75 bps demodulated bitstream against known synchronization sequences — such as those for KG-84 or KW-46, commonly used within NATO for fleet broadcasts — but found no matches. Assuming encryption is indeed present, it likely employs a different or non-standard/proprietary cipher.
As it happens, I reached the same negative results — no recognizable, well-known encryption signature — when examining DHFCS's 1536-bit bitstreams. However, in the case being analyzed the negative result carries considerably more weight:
a) the demodulated 75 bps stream is a single, well-defined user data bitstream, applied directly to the HF modem after the cipher engine.
b) DHFCS's demodulated 1536-bit bitstreams are formed by multiplexing n-channels at the input ports of the multiplexer (DRS GA-205 TDM); since the algorithm governing the multiplexer is unknown, it's impossible to correctly reconstruct the individual per-channel bitstreams.
Thus, a negative result there is far less conclusive, since it simply reflects a raw demodulation of the multiplexer output — i.e., it's a "failed" demultiplexing rather than a genuine absence of known synchronization patterns.
The absence of a recognizable NATO cryptographic signature could plausibly be explained by the use of proprietary, domestic encryption rather than a NATO-standard cipher. Notably, Turkey maintains separate cryptographic algorithms for national versus NATO-approved devices — nationally-developed algorithms are never shared with NATO.
A genuinely national Turkish HF link would therefore be expected to show no correlation with known NATO cipher signatures such as KG-84 or KW-46 [7][8].
It's tempting to speculate that opting for an indigenous, non-NATO cipher might serve a further purpose: shielding this traffic even from the SIGINT facilities hosted within the nearby British Sovereign Base Areas of Akrotiri and Dhekelia. HF skip propagation means physical proximity is no strict prerequisite for interception, but a same-island transmitter would still offer those facilities an unusually short, high-quality intercept path — making a domestic cipher a sensible extra safeguard, even among nominal NATO allies.
It's tempting to speculate that opting for an indigenous, non-NATO cipher might serve a further purpose: shielding this traffic even from the SIGINT facilities hosted within the nearby British Sovereign Base Areas of Akrotiri and Dhekelia. HF skip propagation means physical proximity is no strict prerequisite for interception, but a same-island transmitter would still offer those facilities an unusually short, high-quality intercept path — making a domestic cipher a sensible extra safeguard, even among nominal NATO allies.
## 5. Conclusions
Taken together, the elements discussed above point toward the possibility of a second, Turkish-operated transmitter site sharing the Cyprus/southern-Turkey HF environment, rather than a DHFCS Akrotiri origin, as the source of the 18503.0 kHz traffic. To summarize, this working hypothesis rests on:
a) an atypical waveform choice (75 bps STANAG-4415/MS-110A) for a site whose UDXF-documented profile is dominated by 1200 bps STANAG-4285;
b) the absence of any recognizable NATO cryptographic framing structure in the demodulated bitstream — a stronger indicator than entropy analysis alone, and one reinforced by the fact that the 75 bps stream, unlike DHFCS's multiplexed TDM output, is a single well-defined bitstream where a negative result actually carries weight;
c) a TDoA bearing consistent with the TRNC area, though not uniquely so;
d) the existence of a documented, indigenous Turkish military crypto program (ASELSAN/TÜBİTAK MİLSEC family) capable of explaining the negative crypto match;
e) publicly documented Turkish military communications infrastructure in the TRNC, including the GKK's own Communications & IT Command.
This remains a personal working hypothesis, not a confirmed attribution. The UDXF log records, while suggestive, represent a single archival source — albeit a large one, currently containing more than 300K entries; the TDoA geometry constrains bearing but not range; and the cryptographic argument, however methodologically sound, is ultimately built on an absence of evidence rather than a positive match. Nor can I entirely exclude the possibility that this is simply DHFCS itself, running test transmissions of an atypical waveform — though the extended timeframe over which this traffic has been observed is more consistent with an established, "in-production" capability than with a short-lived trial. A third, unverified log entry (18503.2 kHz, STANAG-4285, 8 May 2026) also remains to be independently checked, and could complicate or reshape this picture.
Continued monitoring of 18503.0 kHz — together with further TDoA passes and, ideally, independent corroboration of the anomalous STANAG-4285 log entry — should help either strengthen or falsify this hypothesis over time. None of this amounts to proof, and I hold this hypothesis loosely. If you have documented information, direct monitoring experience, or technical arguments that support, refine, or contradict it, I'd genuinely welcome hearing from you — constructive criticism, backed by evidence, is exactly what a case like this needs.
Downloads
Signal recordings: https://disk.yandex.com/d/V2jILq8998SyZw
Notes
1. In Direct Sequence Spread Spectrum each data symbol is spread across a fixed 32-chip orthogonal code sequence rather than transmitted as a single symbol, trading bandwidth for resilience at very low SNR.
2. TRNC is a de facto state comprising the northeastern portion of the island of Cyprus. Declared in 1983, it is recognized internationally only by Turkey, while the rest of the international community considers it territory of the Republic of Cyprus under military occupation.
3. In the Western Sovereign Base Area of Cyprus, DHFCS sites include the Salt Lake transmitter (34°36'50"N 32°56'12"E), near Akrotiri, and the Episkopi receiver (34°40'47"N 32°51'24"E), roughly 13 km to the west. Positioned in the eastern Mediterranean, these installations facilitate communications for UK and NATO forces in the Middle East and beyond, enhancing resilience in a key geopolitical theater.
4. The GKK integrates units for tactical communications (HF/VHF/UHF), data encryption, and electronic warfare, part of the wider C4ISR network across Northern Cyprus. Connectivity to the mainland is presumably provided by TAFICS, Turkey's own military communications backbone [9] — which also relies on TÜBİTAK-supplied cryptography, consistent with the indigenous crypto capability discussed in Section 4.2.
5. In military HF operations, the concurrent use of a high-throughput waveform alongside a low-rate, robust-mode waveform for degraded channels or high-priority traffic is common practice, and both can originate from the same transmitter. Modern station architectures employ matrix switches to route multiple HF modems to separate, concurrently active transmitters/antennas, or digitally synthesized exciters generating independent I/Q streams combined at IF/RF. Consequently, simultaneous, multi-frequency dual-waveform operation from a single facility is architecturally unremarkable on its own.
6. UDXF stands for Utility DXers Forum, an online community of radio enthusiasts monitoring non-broadcast HF stations below 30 MHz — including military, maritime, aeronautical, and other "utility" signals, as opposed to broadcasting, pirate, or amateur radio traffic. Active since 2006, it maintains a mailing list through which members exchange logs and technical observations.
3. In the Western Sovereign Base Area of Cyprus, DHFCS sites include the Salt Lake transmitter (34°36'50"N 32°56'12"E), near Akrotiri, and the Episkopi receiver (34°40'47"N 32°51'24"E), roughly 13 km to the west. Positioned in the eastern Mediterranean, these installations facilitate communications for UK and NATO forces in the Middle East and beyond, enhancing resilience in a key geopolitical theater.
4. The GKK integrates units for tactical communications (HF/VHF/UHF), data encryption, and electronic warfare, part of the wider C4ISR network across Northern Cyprus. Connectivity to the mainland is presumably provided by TAFICS, Turkey's own military communications backbone [9] — which also relies on TÜBİTAK-supplied cryptography, consistent with the indigenous crypto capability discussed in Section 4.2.
5. In military HF operations, the concurrent use of a high-throughput waveform alongside a low-rate, robust-mode waveform for degraded channels or high-priority traffic is common practice, and both can originate from the same transmitter. Modern station architectures employ matrix switches to route multiple HF modems to separate, concurrently active transmitters/antennas, or digitally synthesized exciters generating independent I/Q streams combined at IF/RF. Consequently, simultaneous, multi-frequency dual-waveform operation from a single facility is architecturally unremarkable on its own.
6. UDXF stands for Utility DXers Forum, an online community of radio enthusiasts monitoring non-broadcast HF stations below 30 MHz — including military, maritime, aeronautical, and other "utility" signals, as opposed to broadcasting, pirate, or amateur radio traffic. Active since 2006, it maintains a mailing list through which members exchange logs and technical observations.
References
[1] http://linkz.ddns.net:8075/
[2] https://en.wikipedia.org/wiki/Security_Forces_Command
[3] https://www.thenationalherald.com/.../
[4] https://simerini.sigmalive.com/article/2025/9/21/.../
[5] https://udxf.nl/
[6] https://www.mythicsoft.com/agentransack/
[7] https://www.hurriyet.com.tr/gundem/...
[8] https://en.bilgem.tubitak.gov.tr/en/institutional/
[9] https://tskgv.org.tr/savunmasanayiigundem/tsk-ku-bant-uydu-muhabere-sistemi-projesi
[2] https://en.wikipedia.org/wiki/Security_Forces_Command
[3] https://www.thenationalherald.com/.../
[4] https://simerini.sigmalive.com/article/2025/9/21/.../
[5] https://udxf.nl/
[6] https://www.mythicsoft.com/agentransack/
[7] https://www.hurriyet.com.tr/gundem/...
[8] https://en.bilgem.tubitak.gov.tr/en/institutional/
[9] https://tskgv.org.tr/savunmasanayiigundem/tsk-ku-bant-uydu-muhabere-sistemi-projesi
