11592.0 kHz - Unid FSK 41.6 Bd/200 Hz shift (CIS/Rus FSK family?)

An unidentified FSK 41.6 Bd/200 Hz signal on 11592.0 kHz (CF), reminiscent of — but not quite matching — the Russian Navy's well-known T-600/CIS-36-50 family. Still an open case after days of monitoring and a first TDoA attempt.

1. Signal Parameters
Among the FSK utility signals monitored on HF, a transmission on 11592.0 kHz (cf) stands out for its distinctive parameters: approximately 41.6–41.67 Bd with a 200 Hz shift between mark and space tones (Figure 1). The 200 Hz shift value is reminiscent of T-600, a proprietary FSK broadcast system used by the Russian Navy (also known as BEE-36 or CIS 36-50), which is documented to use a 200 Hz shift at more than one baud rate [1]. Neither of these documented rates matches the ~41.6–41.67 Bd observed here, nor does any other published T-600 configuration. At most, then, the shift value can be treated as a family resemblance to the T-600 system rather than a positive identification.

Figure 1: Top: waterfall/spectrogram of the two-tone FSK carrier. Bottom: period/pattern analysis confirming a symbol rate of 41.66 Bd (Br) and a measured shift dF = 201.42 Hz

A further characteristic emerges when examining the phase relationship across successive shifts: the phase of each tone is not preserved from one occurrence to the next, and this holds independently for both the space tone (Figure 2) and the mark tone (Figure 3). This is consistent with the two tones being generated by two independent, free-running oscillators rather than a single voltage-controlled oscillator (VCO) switching frequency while preserving phase continuity — a scheme under which no phase discontinuity would be expected at the shifts.

Figure 2: Persistence display of the space tone across successive shifts. The Δθ arrows mark the phase offset between successive shifts, showing that phase is not preserved.

Figure 3: Persistence display of the mark tone across successive shifts, showing the same lack of phase continuity.

 

A straightforward computation from the persistence displays confirms these tone frequencies. Measuring the elapsed time across two cycles gives 0.002220733 s for the space tone and 0.001815733 s for the mark tone, corresponding to (respectively):
2 / 0.002220733 ≈ 900.60 Hz
2 / 0.001822133 ≈ 1097.61 Hz
The resulting shift (≈197 Hz) is consistent with the previously measured dF = 201.42 Hz (Figure 1), and the tone pair's midpoint (≈1001.0 Hz) matches the expected ~1000 Hz baseband position given the 1 kHz USB dial offset used for the recording.

 

2. Transmission Pattern
The frequency neighborhood around 11592.0 kHz offers additional context for the transmission pattern described below: a recent capture (Figure 4) shows the station idling while two confirmed Russian BEE/50 circuits nearby actively carry crypto traffic — at 11598 kHz (200 Hz shift) and 11603 kHz (250 Hz shift), the same shift variability already noted for the T-600/CIS 36-50 family in Section 1. Unlike its neighbours at the time of capture, 11592.0 kHz was idling, consistent with the traffic pattern discussed in this section.

Figure 4 – Frequency neighborhood snapshot: 11592.0 kHz idling alongside two confirmed Russian BEE/50 circuits actively carrying crypto traffic, at 11598 kHz (200 Hz shift) and 11603 kHz (250 Hz shift).

The bulk of the observed traffic consists of idling — the regular "01"s sequences also known as eversals. Transmissions begin around 0800 UTC, with no preceding call-up or announcement (Figure 5, top), and continue for roughly ten hours, until approximately 1800 UTC, ending as abruptly as they begin, with no sign-off (Figure 6). The on- and off-times are not perfectly fixed: variations of more than a minute have been observed on repeated occasions, which is consistent with — though does not confirm — manual start/stop of the transmission rather than a strictly clock-driven schedule. The idling phase is occasionally interrupted by brief N0N(1) transmissions on the space-tone frequency, before resuming the normal alternating pattern (Figure 5, bottom).

Figure 5: Top: onset of transmission with no preamble. Bottom: idling briefly interrupted by an N0N transmission on the "space" requency.

Figure 6: End of transmission: the reversals pattern cuts off abruptly into noise, with no sign-off (recording started 17 September 2026, 17:35:34 UTC; the .wav file was later trimmed to isolate the transmission's closing segment).

Very short N0N interruptions were also recorded during some monitoring sessions (Figure 7).

Figure 7: Reversals sequence briefly interrupted by N0N transmissions on the space frequency.

Nighttime monitoring (beyond the 1800–0800 UTC window) has so far only been carried out on a few occasions but without receptions of the signal of interest. Given that this null result is consistent with the daytime-only schedule already established above, it does not by itself indicate a separate nighttime frequency. One plausible explanation, common to HF fixed/military links, is that 11592.0 kHz (cf) could serve as the daytime channel with a distinct, as-yet-unidentified frequency used at night(2). No candidate night frequency carrying the same modem signature has been found so far, so this remains an open hypothesis for future monitoring rather than an established fact.

3. Attribution Assessment
Geolocation. Four independent TDoA runs were carried out using a European KiwiSDR receiver network (nodes in/near Germany, Poland, the Slovakia/Hungary border, Croatia, Italy, and Greece), with no receiver coverage east of the target. Given this geometry, all baselines approach the emitter from broadly the same direction, producing hyperbolic lines of position that intersect at shallow angles — which limits precision along that bearing.
Results. The four fixes (44.40N/32.60E, 44.80N/30.80E, 43.60N/30.40E, 45.00N/32.20E) cluster within roughly 150–230 km of each other (Figure 8), in the northwestern Black Sea / southern Ukraine coast / Crimea-approaches area that overlaps the operating theatre of Russia's Black Sea Fleet (home-ported at Sevastopol, Crimea), which is consistent with — though does not confirm — the CIS-36-50/Russian Navy family hypothesis raised above, possibly as a shore-to-ship link. Resolving the emitter's location further would require at least one receiver east of the target to break the current fan geometry; until then, this result stands as a corroborating but non-conclusive data point.

Figure 8 – Four independent TDoA fixes for the 11592.0 kHz signal, clustering in the northwestern Black Sea / Crimea-approaches area.

Hardware attribution. Beyond geolocation, no hardware or cryptographic device designation can currently be attributed to this signal — and indeed, no meaningful statement about its encryption can be made at all, since no actual data traffic has yet been captured: everything observed so far consists of idling and N0N segments, neither of which carries any cryptographic content to analyze. Some sources associate similarly-parametered Russian military/government FSK modes with specific T-series cipher devices or R-series radio terminals, but none of these attributions match the 41.6–41.67 Bd / 200 Hz combination observed here, and no corroborating source has been found for a name or nickname specific to this signal. Pending further monitoring and input from other analysts, the transmission is best treated as unidentified, tentatively consistent with a CIS/Russian military or government FSK family.

4. Preliminary Conclusions
Why the idling? Continuous idling of this kind can be attributed to several different operational, technical, or strategic rationales. It may serve to keep the frequency occupied, preventing other stations or commercial broadcasters from using the same channel. It also allows automatic receivers — presumably off-shore ones  —  to stay synchronized with the carrier's clock, ready to lock onto the traffic the instant real transmission begins. In the author's experience, however, this frequency has often been monitored for extended periods without any traffic being heard beyond the idling tone, though this alone is not sufficient to characterize the purpose of the station.
Alternative explanations. Other explanations for the extended idling remain equally speculative. One possibility, consistent with the TDoA-supported shore-to-ship hypothesis (Section 3), is that this behaves as a fleet broadcast, where actual data traffic is typically brief and occurs only when there is a genuine dispatch to send. It could also serve as a continuous propagation test on this specific frequency, or represent a reserve channel — loosely termed here a "ghost net" — kept active by a secondary control station while the main operational network routes traffic elsewhere, for example over primary frequencies offering better propagation at a given time.
The frequency neighborhood. The frequency picture in Figure 4 also raises questions that remain speculative, grounded only in the signals' own characteristics rather than in any further evidence: why would FSK broadcasts sitting so close together in frequency use different shift configurations, and could this reflect different intended recipients tuned to different channels, possibly with some form of channel prioritization? In the author's experience, a loose parallel exists with NATO FSK broadcasts [2], which commonly use 50/75 Bd with an 850 Hz shift — though under different encryption (KW-46 or KG-84), making the comparison structural at best rather than substantive.

Only future — and hopefully more fortunate — captures that include an actual dispatch transmission are likely to provide more definitive answers. Friends who may have recordings of this signal, particularly from nighttime hours or capturing an actual burst of traffic, are warmly invited to get in touch at tony.anselmi@gmail.com.

Downloads

---

Signal recordings: https://disk.yandex.com/d/_U2lItInFJNeEg

Notes

---

1.In shortwave radio monitoring and ITU emission classification, N0N is an emission designator that stands for a continuous, unmodulated carrier carrying no information.

2. For example, the HFGCS network uses 11175 kHz as its main daytime frequency and 4724 kHz at night.

References

---

[1] http://i56578-swl.blogspot.com/2016/10/cis-navy-50bd200-fsk-t600-bee-36-cis-36.html
[2] https://i56578-swl.blogspot.com/p/nato-4481f-brassmrl.html

STANAG-4415/MS-110A 75 bps Robust Waveform — Physical Layer Reference

A consolidated technical reference on the 75 bps STANAG-4415/MS-110A waveform observed on 18503.0 kHz, combining the physical-layer characterization from [1] with the framing findings from [2]. This post exists because that characterization was originally split across two separate write-ups — one on the RF/physical layer, one on framing behaviour. The split obscured a connection between them: the physical-layer absence of mini-probes (§2.2) means the base waveform has no built-in way for a receiver to join a transmission already in progress — and preamble re-injection (§3.2) is precisely what closes that gap, through a modification not present in the base STANAG-4415/MS-110A specification itself (though, as §3.2 details, with real precedent elsewhere in the STANAG family). Reading the two findings together makes that connection visible in a way that reading either post alone does not. Site attribution is deliberately out of scope here — see the two source posts for that discussion.

1. Operational overview
At the reception level, this waveform cannot be told apart from a standard MIL-STD-188-110A 75 bps transmission. STANAG-4415 and the MS-110A 75 bps robust mode are, at the RF signature level, the same waveform: same DSSS Walsh modulation, same fixed 2400 Bd symbol rate. A receiver — even a military-grade one, such as the L3Harris RF-5710A — demodulates both interchangeably; the distinction between the two standard labels comes down to a front-panel setting, not anything recoverable from the intercepted signal itself.
The relationship between the two standards was formalized over time: MS-110B (2000) §5.3.1.3.h lists the robust 75 bps mode as optional, specifying it "shall be in accordance with STANAG 4415." In other words, from MS-110B onward the US standard defines this mode by reference to the NATO one rather than specifying it natively — a distinction that matters for conformance testing, not for what a receiver actually sees.
The one real difference sits on the receiver design side: a modem built to fully meet STANAG-4415's stricter performance requirements can decode at lower SNR (down to roughly -9/-11 dB in 3 kHz AWGN) than one meeting only the baseline MS-110A target. This is a measurable difference in comparative lab testing (BER vs. SNR/multipath/Doppler) — not something inferable from intercepted bursts.

2.  Physical layer — signal and modulation characteristics
2.1 Signal acquisition
Initial demodulator lock shows a carrier at 1801.29 Hz (USB, +1801.4 Hz offset), a symbol rate of ~2400.22–2400.33 Bd, and an 8-ary constellation — consistent with the 2400 Bd, 8-PSK tribit-symbol architecture shared across the MS-110A serial-tone family.

Figure 1: signal acquisition and demodulator lock; arrow marks the preamble at the start of a new message.

2.2 Absence of mini-probes
Neither STANAG-4415 nor the MS-110A 75 bps mode uses mini-probes (the periodic resync sequences found in 150–4800 bps serial-tone modes). At 75 bps this isn't needed: DSSS Walsh spreading at a fixed 2400 Bd is inherently redundant per bit, so channel tracking and noise immunity come from the spreading itself rather than periodic re-training. MIL-STD-188-110A Table XIX confirms this directly — the 75 bps row lists 0 known symbols for this purpose.

Figure 2: MIL-STD-188-110A, Table XIX: the 75 bps row shows 0 known symbols.

At the architecture level (per STANAG-4415 Figure 2.1), switches SW2/SW3 toggle only between "sync preamble" and "data" phases, with no third state for reinserting an intermediate probe sequence — consistent with the absence of mini-probes. SW1 stays fixed on "input data" throughout both phases, since preamble and each interleave block share the same duration, keeping the interleaver continuously pre-loaded.

 

Figure 3: 75 bps modem architecture — SW2/SW3 switching between "b" (sync preamble) and "a" (data phase), while SW1 remains fixed, continuously pre-loading the interleaver with input data throughout both phases.

A practical consequence: a single preamble with no mid-stream mini-probes cannot, on its own, support late-entry acquisition — the base standard has no built-in mechanism for a receiver to join an in-progress transmission (see §3 below for how this implementation addresses that gap).

2.3 Walsh modulation, verified
Though Walsh modulation is formally specified in both standards, its presence was verified directly via carrier regeneration (squarer/m-th power loop). Squaring at exponent n=2 produces a clean spectral line confined to the preamble — proof of an underlying BPSK-type modulation beneath the Walsh chips. At exponent n=8, that line disappears completely across both preamble and data, confirming the underlying signal is masked BPSK rather than native 8-PSK.

Figure 4: squaring-loop spectral analysis at n=2 and n=8.

2.4 Preamble structure
Per MS-110A §5.3.2.3.7.2.1, the synchronization pattern consists of either three or twenty-four superframes, depending on the interleave setting. For the long-interleave 75 bps mode observed here: a 4.8 s preamble comprising 24 superframes of 200 ms each, each carrying 15 orthogonally Walsh-modulated channel symbols — 480 tribit symbols, or 1440 bits, per superframe. Measured ACF confirms both the 200 ms superframe period and the 4.8 s total preamble length.

Figure 5a: MS-110A frame structure (Preamble, interleaved data, EOM & Flush), showing how the preamble is composed of superframes (SF1...SFm).

Figure 5b: ACF of the sync preamble: peaks recurring at ~200 ms (dT = 200.609 ms) confirm the STANAG-4415/MS-110A sync pattern over the 4.8 s long-interleave preamble (dT = 4.799999 s).

Figure 5c: Initial section (preamble) of the bitstream showing the 1440-bit frame width across 24 superframes.

2.5 Data block ACF
The data segment following the preamble shows periodic ACF peaks every 66.67 ms (160 over-the-air symbols) — not a framing artifact, but the result of MS-110A's own data-scrambling sequence (per §5.3.2.3.8).

 

Figure 6 — ACF of the data segment.

3. Physical layer — framing behaviour beyond the base specification
Extended monitoring surfaced two characteristics of this 75 bps implementation that are not accounted for in the STANAG-4415/MS-110A reference specification.

3.1 Preamble onset delay
Although transmissions appear to begin "from nothing," some instances open with two extended tones at 1000 Hz and 1600 Hz, followed by a segment of 8-PSK modulation that cannot be demodulated without a preamble lock. In these cases the preamble is not transmitted at the start of the signal, but with measurable delays on the order of 50–60 seconds.

Figure 7: Comparison of signal start structures: anomalous transmission with initial 1000/1600 Hz tones and a delayed preamble (~50–60 s) (top), and standard transmission beginning immediately with the preamble before data (bottom).

3.2 Preamble re-injection
The more significant feature. In long transmissions, the full preamble is regularly re-injected every 115.2 seconds of data, forming a fixed 120-second cycle (4.8 s preamble + 115.2 s data) that repeats until the transmission ends. This 115.2-second span is exact, not approximate: it equals 24 blocks of long-interleave data, 4.8 seconds each — matching, block for block, the 24-superframe structure of the preamble itself (§2.4). Re-injection only engages once a transmission exceeds one full 24-block cycle; shorter transmissions carry a single preamble followed directly by up to 24 data blocks and end-of-message.

Figure 8: waterfall confirming the claims above — top: four consecutive re-injection cycles over roughly 8 minutes, showing the pattern repeats for as long as the transmission continues; bottom: zoomed view of one cycle, with a measured interval of 120.064 s between Preamble n and Preamble n+1, matching the nominal 120 s (2 mins) cycle to within 64 ms.

Figure 9: block structure of the repeating cycle — top: preamble followed by up to 24 data blocks per 120 s cycle, repeating until a final partial cycle closes with EOM; bottom: transmissions shorter than one cycle, carrying a single preamble followed directly by up to 24 data blocks and EOM.

This alignment is unlikely to be coincidental: 24 is also the number of superframes making up the long interleaver itself, meaning the reinsertion point falls precisely on the interleaver's structural boundary — and its strict periodicity points to a predefined acquisition mechanism rather than a reactive response to poor channel conditions.
Since this waveform is not autobaud and does not use mini-probes (§2.2), retransmitting the full preamble at known intervals adds:
(a) greater transmission robustness ;
(b) easier synchronization on late entry — a receiver joining mid-transmission gets a re-entry window every 115.2 seconds instead of having to wait for the entire transmission (which, for broadcasts, can run for tens of minutes) to end.

This isn't an isolated, one-off invention: it looks like a synchronization method already standardized elsewhere in the STANAG family, reused here. STANAG 4539 §4.3.1 explicitly defines a "reinserted preamble," distinct from the initial synchronisation preamble, whose stated purpose is to facilitate acquisition of an ongoing transmission (acquisition on data) — functionally identical to what's observed here — as does MIL-STD-188-110C Appendix D §D.5.4. However, MIL-STD-188-110C Change Notice-1 later removed the corresponding sentence, because the feature was considered obsolete in that context. No trace of any equivalent clause appears in STANAG-4415/MS-110A's own 75 bps text, so within this specific waveform it remains an addition beyond the base specification — one with real, if since-contested, precedent elsewhere in the STANAG/MIL-STD family.

References

---

[1] https://i56578-swl.blogspot.com/2026/08/75-bps-serial-tone-4415110a-from-cyprus.html
[2] https://i56578-swl.blogspot.com/2026/09/185030-khz-from-cyprus-new-waveform.html

18503.0 kHz from Cyprus — New Waveform Findings, and Akrotiri Confirmed

A follow-up to the 75 bps serial tone (4415/110A) from Cyprus post [1] 

A friend and colleague pointed me to a few mailing list posts regarding receptions on 18503.0 kHz, shared by the users F1GOC, Kosmod, Linkz, and mco. These messages address the questions and doubts raised in the original post about the origin of the transmission ("Was it Akrotiri?"). They date to February and to August–November 2025, predating both the original post and this addendum, and are therefore independent of them. Their posts indicate receptions of STANAG-4415 75L, STANAG-4285 1200L, and even FSK 800/850 waveforms that are all consistent with the operational modes used by DHFCS. The STANAG-4285 1200/Long case is the most important one: demodulation yields a 1536-bit bitstream, observed and analysed across multiple sessions, that is as a distinctive signature of DHFCS rather than a generic mode match. Further bitstream analysis on the same capture (source Linkz) turned up a recurring alphabet/numbers test pattern, which could point to routine calibration or test sessions rather than live operational traffic.
Based on their receptions & TDoA results, the origin can now be treated as confirmed: DHFCS Akrotiri. 

The extended monitoring behind this analysis turned up more than an answer to where the signal originates: it also documented two new characteristics of the STANAG-4415/MS-110A 75 bps waveform — informally known as the Robust Waveform — that are not covered by the reference specification, which are discussed below before we return to the TDoA and UDXF points raised in the previous post and now resolved.

1. New waveform-level characteristics
Both are detailed below: a delay in the onset of the preamble, and its periodic re-injection during long transmissions.

1.1. Preamble onset delay
Although transmissions appear to begin "from nothing," some instances open with two extended tones at 1000 Hz and 1600 Hz, followed by a segment of 8-PSK modulation that cannot be demodulated without a preamble lock (Figure 1). In these cases the preamble is not transmitted at the start of the signal, but with measurable delays on the order of 50–60 seconds.

Figure 1. Comparison of signal start structures: anomalous transmission with initial 1000/1600 Hz tones and a delayed preamble (~50–60 s) (top), and standard transmission beginning immediately with the preamble before data (bottom).

1.2. Preamble re-injection
This is the more significant feature. In long transmissions, the full preamble is regularly re-injected every 115.2 seconds of data, forming a fixed 120-second or 2 minutes cycle (4.8 s preamble + 115.2 s data) that repeats until the transmission ends (Figure 2). This 115.2-second span is not approximate: it equals exactly 24 blocks of long-interleave data, 4.8 seconds each, matching the frame structure shown in Figure 3.
Re-injection only happens once a transmission exceeds one full 24-block cycle; shorter transmissions have a single preamble followed directly by up to 24 data blocks and EOM, as shown in the bottom row of Figure 3. This is unlikely to be coincidental: the number 24 is also the number of superframes that make up the long interleaver itself, meaning the reinsertion point falls precisely on the interleaver's structural boundary — and its strict periodicity points to a predefined acquisition mechanism rather than a reactive response to poor channel conditions.

Figure 2: waterfall confirming the claims above — top: four consecutive re-injection cycles over roughly 8 minutes, showing the pattern repeats for as long as the transmission continues; bottom: zoomed view of one cycle, with a measured interval of 120.064 s between Preamble n and Preamble n+1, matching the nominal 120 s (2 mins) cycle to within 64 ms.

Figure 3: block structure of the repeating cycle — top: preamble followed by up to 24 data blocks per 120 s cycle, repeating until a final partial cycle closes with EOM; bottom: transmissions shorter than one cycle, carrying a single preamble followed directly by up to 24 data blocks and EOM.

In my assessment, this preamble re-injection is an addition beyond the base STANAG-4415/MS-110A 75 bps specification. Since this waveform is not autobaud and does not use mini-probes, retransmitting the full preamble at known intervals adds:
a) greater transmission robustness;
b) easier synchronization on late entry — by offering a re-entry window every 115.2 seconds. This way, receiving modems don't need to wait for the current transmission to end (which, for broadcasts, can run for several tens of minutes) to lock onto a new preamble. This no longer looks like something invented just for this signal. It looks more like a synchronization method already standardized elsewhere in the STANAG family, simply reused here.

Indeed, the concept itself has NATO precedent: STANAG-4539 (08-JUN-2025) §4.3.1 explicitly defines a "reinserted preamble," distinct from the initial synchronisation preamble, whose stated purpose is to facilitate acquisition of an ongoing transmission (acquisition on data) — functionally identical to what's observed here, as does MS-110C Appendix D §D.5.4 (23-SEP-2011). However, MS-110C Change Notice-1 (03-JAN-2012) later removed the sentence "The reinserted preamble facilitates acquisition (or re-acquisition) of an ongoing broadcast transmission." because the feature was considered obsolete.

2. Specific objections, now resolved
With the origin no longer in question, it's worth revisiting the two points raised earlier — not to re-argue them, but to show plainly why they couldn't have closed the case on their own.

 

2.1. Why the TDoA result alone couldn't resolve it
The original post described the geolocation as "consistent with, but not uniquely pinpointing" the TRNC area. The KiwiSDR TDoA extension doesn't output formal error-ellipse statistics (axis lengths, confidence level) — it only renders the solution ellipse visually. What it does give is the receiver geometry actually used: which Kiwis contributed to the result, their baseline separation, and an approximate ellipse size read off the map scale.
Geometry is the dominant factor here. A cluster of receivers — close to each other, regardless of their distance from the target — produces nearly parallel hyperbolas in the area of the transmitter, meaning poor resolution, or high GDOP (Geometric Dilution of Precision)(1), as shown below in Figure 4.

Figure 4: Simplified schematic, not to scale: clustered receivers (left) yield nearly parallel sightlines and an elongated uncertainty area; spread receivers (right) yield wide-angle sightlines and a compact one.

This is visible in Figure 9a of the original post: the solution lines converge at a shallow angle, and their angling shifts depending on which cluster produced them — which is exactly why the resulting ellipses ran elongated along the Cyprus–southern Turkey axis rather than closing down to a point.
The KiwiSDR network has always had poor coverage in the Mediterranean and Southern Europe: this means relying mostly on receivers in Northern Europe, which degrades the GDOP for a target actually located in the Mediterranean.
However, the geometric limitation is not a flaw in the method — it is simply a result of which KiwiSDR receivers were available. Other TDoA results, like those behind the F1GOC/mco/Linkz/Kosmod mailing-list posts, may have benefited from a better receiver cluster and better HF propagation conditions at that time than those available for the analysis in the previous post.

2.2. The anomalous UDXF entry, and why open-web search missed all of this
The anomalous STANAG-4285/18503.2 kHz log (UDXF logs: WO, 8 May 2026), cited in the original post, now has a plausible match in Linkz's post from less than a year prior (13 August 2025): that same frequency carried, among other modes, DHFCS STANAG-4285 1200/Long traffic.
That connection didn't come from previous searches, though. I ran broad OSINT and open-web searches both before and after the earlier post was published, looking for confirmation of the transmitter's origin. Those searches turned up nothing substantial — not the above-mentioned F1GOC/mco/Linkz/Kosmod posts, despite those predating this analysis by close to a year. It took a colleague's direct pointer to surface the relevant mailing lists.

This isn't about a lack of evidence, but about where that evidence lives: specialist mailing lists of this kind are effectively invisible to general web search engines and OSINT tooling — they aren't indexed, aren't crawled, and aren't reachable through the kind of queries that usually work for open-source material. I'm subscribed to some of the lists in question myself, and I still missed the relevant messages at the time — a gap in my own monitoring discipline, not proof that the material wasn't circulating. 

 3. Open questions
A few points remain genuinely unresolved. Without more specific sources or hard evidence, discussing them further here would mean speculating rather than analysing — so they're simply indicated, to be revisited if better information comes along:

- Why this particular, modified 75 bps Robust Waveform at all, when STANAG-4285, conventional MIL-STD-188-110A modes, and FSK are all in routine use on the same frequency and by the same operator.
- The encryption in use doesn't match what's typically expected in this kind of context (KG-84/KW-46).
- What these transmissions are actually for.
- Frequent listening sessions (10–20 minutes, about every hour) have found no daytime activity at all on 18503.0 kHz on some days — a real pattern, given how often I listened. Night hours weren't checked, but that gap may not matter much: HF propagation on 18 MHz usually gets much weaker after dark, so — assuming some days do carry an exclusively night-time schedule — such transmissions might not reach here anyway.

The original post wasn't written to argue a case, but to lay out an open question with its uncertainties stated plainly. That the answer turned out to be traceable — independently, by others, before this piece was even written — is the outcome that kind of approach is meant to produce.

Notes

---

1. GDOP is a measure of how much receiver geometry amplifies timing error into position error — the more parallel the hyperbolas the worse the result.

References

---

[1] https://i56578-swl.blogspot.com/2026/08/75-bps-serial-tone-4415110a-from-cyprus.html