A follow-up to the 75 bps serial tone (4415/110A) from Cyprus post [1]
A friend and colleague pointed me to a few mailing list posts regarding receptions on 18503.0 kHz, shared by the users F1GOC, Kosmod, Linkz, and mco. These messages address the questions and doubts raised in the original post about the origin of the transmission ("Was it Akrotiri?"). They date to February and to August–November 2025, predating both the original post and this addendum, and are therefore independent of them. Their posts indicate receptions of STANAG-4415 75L, STANAG-4285 1200L, and even FSK 800/850 waveforms that are all consistent with the operational modes used by DHFCS. The STANAG-4285 1200/Long case is the most important one: demodulation yields a 1536-bit bitstream, observed and analysed across multiple sessions, that is as a distinctive signature of DHFCS rather than a generic mode match. Further bitstream analysis on the same capture (source Linkz) turned up a recurring alphabet/numbers test pattern, which could point to routine calibration or test sessions rather than live operational traffic.
Based on their receptions & TDoA results, the origin can now be treated as confirmed: DHFCS Akrotiri.
The extended monitoring behind this analysis turned up more than an answer to where the signal originates: it also documented two new characteristics of the STANAG-4415/MS-110A 75 bps waveform — informally known as the Robust Waveform — that are not covered by the reference specification, which are discussed below before we return to the TDoA and UDXF points raised in the previous post and now resolved.
1. New waveform-level characteristics
Both are detailed below: a delay in the onset of the preamble, and its periodic re-injection during long transmissions.
1.1. Preamble onset delay
Although transmissions appear to begin "from nothing," some instances open with two extended tones at 1000 Hz and 1600 Hz, followed by a segment of 8-PSK modulation that cannot be demodulated without a preamble lock (Figure 1). In these cases the preamble is not transmitted at the start of the signal, but with measurable delays on the order of 50–60 seconds.
 |
| Figure 1. Comparison of signal start structures: anomalous transmission with initial 1000/1600 Hz tones and a delayed preamble (~50–60 s) (top), and standard transmission beginning immediately with the preamble before data (bottom). |
This is the more significant feature. In long transmissions, the full preamble is regularly re-injected every 115.2 seconds of data, forming a fixed 120-second or 2 minutes cycle (4.8 s preamble + 115.2 s data) that repeats until the transmission ends (Figure 2). This 115.2-second span is not approximate: it equals exactly 24 blocks of long-interleave data, 4.8 seconds each, matching the frame structure shown in Figure 3.
Re-injection only happens once a transmission exceeds one full 24-block cycle; shorter transmissions have a single preamble followed directly by up to 24 data blocks and EOM, as shown in the bottom row of Figure 3. This is unlikely to be coincidental: the number 24 is also the number of superframes that make up the long interleaver itself, meaning the reinsertion point falls precisely on the interleaver's structural boundary — and its strict periodicity points to a predefined acquisition mechanism rather than a reactive response to poor channel conditions.
 |
| Figure 2: waterfall confirming the claims above — top: four consecutive re-injection cycles over roughly 8 minutes, showing the pattern repeats for as long as the transmission continues; bottom: zoomed view of one cycle, with a measured interval of 120.064 s between Preamble n and Preamble n+1, matching the nominal 120 s (2 mins) cycle to within 64 ms. |
 |
| Figure 3: block structure of the repeating cycle — top: preamble followed by up to 24 data blocks per 120 s cycle, repeating until a final partial cycle closes with EOM; bottom: transmissions shorter than one cycle, carrying a single preamble followed directly by up to 24 data blocks and EOM. |
a) greater transmission robustness;
b) easier synchronization on late entry — by offering a re-entry window every 115.2 seconds. This way, receiving modems don't need to wait for the current transmission to end (which, for broadcasts, can run for several tens of minutes) to lock onto a new preamble. This no longer looks like something invented just for this signal. It looks more like a synchronization method already standardized elsewhere in the STANAG family, simply reused here.
Indeed, the concept itself has NATO precedent: STANAG-4539 (08-JUN-2025) §4.3.1 explicitly defines a "reinserted preamble," distinct from the initial synchronisation preamble, whose stated purpose is to facilitate acquisition of an ongoing transmission (acquisition on data) — functionally identical to what's observed here, as does MS-110C Appendix D §D.5.4 (23-SEP-2011). However, MS-110C Change Notice-1 (03-JAN-2012) later removed the sentence "The reinserted preamble facilitates acquisition (or re-acquisition) of an ongoing broadcast transmission." because the feature was considered obsolete.
2. Specific objections, now resolved
With the origin no longer in question, it's worth revisiting the two points raised earlier — not to re-argue them, but to show plainly why they couldn't have closed the case on their own.
The original post described the geolocation as "consistent with, but not uniquely pinpointing" the TRNC area. The KiwiSDR TDoA extension doesn't output formal error-ellipse statistics (axis lengths, confidence level) — it only renders the solution ellipse visually. What it does give is the receiver geometry actually used: which Kiwis contributed to the result, their baseline separation, and an approximate ellipse size read off the map scale.
Geometry is the dominant factor here. A cluster of receivers — close to each other, regardless of their distance from the target — produces nearly parallel hyperbolas in the area of the transmitter, meaning poor resolution, or high GDOP (Geometric Dilution of Precision)(1), as shown below in Figure 4.
 |
| Figure 4: Simplified schematic, not to scale: clustered receivers (left) yield nearly parallel sightlines and an elongated uncertainty area; spread receivers (right) yield wide-angle sightlines and a compact one. |
The KiwiSDR network has always had poor coverage in the Mediterranean and Southern Europe: this means relying mostly on receivers in Northern Europe, which degrades the GDOP for a target actually located in the Mediterranean.
However, the geometric limitation is not a flaw in the method — it is simply a result of which KiwiSDR receivers were available. Other TDoA results, like those behind the F1GOC/mco/Linkz/Kosmod mailing-list posts, may have benefited from a better receiver cluster and better HF propagation conditions at that time than those available for the analysis in the previous post.
2.2. The anomalous UDXF entry, and why open-web search missed all of this
The anomalous STANAG-4285/18503.2 kHz log (UDXF logs: WO, 8 May 2026), cited in the original post, now has a plausible match in Linkz's post from less than a year prior (13 August 2025): that same frequency carried, among other modes, DHFCS STANAG-4285 1200/Long traffic.
That connection didn't come from previous searches, though. I ran broad OSINT and open-web searches both before and after the earlier post was published, looking for confirmation of the transmitter's origin. Those searches turned up nothing substantial — not the above-mentioned F1GOC/mco/Linkz/Kosmod posts, despite those predating this analysis by close to a year. It took a colleague's direct pointer to surface the relevant mailing lists.
This isn't about a lack of evidence, but about where that evidence lives: specialist mailing lists of this kind are effectively invisible to general web search engines and OSINT tooling — they aren't indexed, aren't crawled, and aren't reachable through the kind of queries that usually work for open-source material. I'm subscribed to some of the lists in question myself, and I still missed the relevant messages at the time — a gap in my own monitoring discipline, not proof that the material wasn't circulating.
3. Open questions
A few points remain genuinely unresolved. Without more specific sources or hard evidence, discussing them further here would mean speculating rather than analysing — so they're simply indicated, to be revisited if better information comes along:
- Why this particular, modified 75 bps Robust Waveform at all, when STANAG-4285, conventional MIL-STD-188-110A modes, and FSK are all in routine use on the same frequency and by the same operator.
- The encryption in use doesn't match what's typically expected in this kind of context (KG-84/KW-46).
- What these transmissions are actually for.
- Frequent listening sessions (10–20 minutes, about every hour) have found no daytime activity at all on 18503.0 kHz on some days — a real pattern, given how often I listened. Night hours weren't checked, but that gap may not matter much: HF propagation on 18 MHz usually gets much weaker after dark, so — assuming some days do carry an exclusively night-time schedule — such transmissions might not reach here anyway.
The original post wasn't written to argue a case, but to lay out an open question with its uncertainties stated plainly. That the answer turned out to be traceable — independently, by others, before this piece was even written — is the outcome that kind of approach is meant to produce.
