An unidentified FSK 41.6 Bd/200 Hz signal on 11592.0 kHz (CF), reminiscent of — but not quite matching — the Russian Navy's well-known T-600/CIS-36-50 family. Still an open case after days of monitoring and a first TDoA attempt.
1. Signal Parameters
Among the FSK utility signals monitored on HF, a transmission on 11592.0 kHz (cf) stands out for its distinctive parameters: approximately 41.6–41.67 Bd with a 200 Hz shift between mark and space tones (Figure 1). The 200 Hz shift value is reminiscent of T-600, a proprietary FSK broadcast system used by the Russian Navy (also known as BEE-36 or CIS 36-50), which is documented to use a 200 Hz shift at more than one baud rate [1]. Neither of these documented rates matches the ~41.6–41.67 Bd observed here, nor does any other published T-600 configuration. At most, then, the shift value can be treated as a family resemblance to the T-600 system rather than a positive identification.
 |
| Figure 1: Top: waterfall/spectrogram of the two-tone FSK carrier. Bottom: period/pattern analysis confirming a symbol rate of 41.66 Bd (Br) and a measured shift dF = 201.42 Hz |
 |
| Figure 2: Persistence display of the space tone across successive shifts. The Δθ arrows mark the phase offset between successive shifts, showing that phase is not preserved. |
 |
| Figure 3: Persistence display of the mark tone across successive shifts, showing the same lack of phase continuity. |
2 / 0.002220733 ≈ 900.60 Hz
2 / 0.001822133 ≈ 1097.61 Hz
The resulting shift (≈197 Hz) is consistent with the previously measured dF = 201.42 Hz (Figure 1), and the tone pair's midpoint (≈1001.0 Hz) matches the expected ~1000 Hz baseband position given the 1 kHz USB dial offset used for the recording.
The frequency neighborhood around 11592.0 kHz offers additional context for the transmission pattern described below: a recent capture (Figure 4) shows the station idling while two confirmed Russian BEE/50 circuits nearby actively carry crypto traffic — at 11598 kHz (200 Hz shift) and 11603 kHz (250 Hz shift), the same shift variability already noted for the T-600/CIS 36-50 family in Section 1. Unlike its neighbours at the time of capture, 11592.0 kHz was idling, consistent with the traffic pattern discussed in this section.
 |
| Figure 4 – Frequency neighborhood snapshot: 11592.0 kHz idling alongside two confirmed Russian BEE/50 circuits actively carrying crypto traffic, at 11598 kHz (200 Hz shift) and 11603 kHz (250 Hz shift). |
The bulk of the observed traffic consists of idling — the regular "01"s sequences also known as eversals. Transmissions begin around 0800 UTC, with no preceding call-up or announcement (Figure 5, top), and continue for roughly ten hours, until approximately 1800 UTC, ending as abruptly as they begin, with no sign-off (Figure 6). The on- and off-times are not perfectly fixed: variations of more than a minute have been observed on repeated occasions, which is consistent with — though does not confirm — manual start/stop of the transmission rather than a strictly clock-driven schedule. The idling phase is occasionally interrupted by brief N0N(1) transmissions on the space-tone frequency, before resuming the normal alternating pattern (Figure 5, bottom).
 |
Figure 5: Top: onset of transmission with no preamble. Bottom: idling briefly interrupted by an N0N transmission on the "space" requency. |
 |
| Figure 6: End of transmission: the reversals pattern cuts off abruptly into noise, with no sign-off (recording started 17 September 2026, 17:35:34 UTC; the .wav file was later trimmed to isolate the transmission's closing segment). |
Very short N0N interruptions were also recorded during some monitoring sessions (Figure 7).
 |
| Figure 7: Reversals sequence briefly interrupted by N0N transmissions on the space frequency. |
Nighttime monitoring (beyond the 1800–0800 UTC window) has so far only been carried out on a few occasions but without receptions of the signal of interest. Given that this null result is consistent with the daytime-only schedule already established above, it does not by itself indicate a separate nighttime frequency. One plausible explanation, common to HF fixed/military links, is that 11592.0 kHz (cf) could serve as the daytime channel with a distinct, as-yet-unidentified frequency used at night(2). No candidate night frequency carrying the same modem signature has been found so far, so this remains an open hypothesis for future monitoring rather than an established fact.
3. Attribution Assessment
Geolocation. Four independent TDoA runs were carried out using a European KiwiSDR receiver network (nodes in/near Germany, Poland, the Slovakia/Hungary border, Croatia, Italy, and Greece), with no receiver coverage east of the target. Given this geometry, all baselines approach the emitter from broadly the same direction, producing hyperbolic lines of position that intersect at shallow angles — which limits precision along that bearing.
Results. The four fixes (44.40N/32.60E, 44.80N/30.80E, 43.60N/30.40E, 45.00N/32.20E) cluster within roughly 150–230 km of each other (Figure 8), in the northwestern Black Sea / southern Ukraine coast / Crimea-approaches area that overlaps the operating theatre of Russia's Black Sea Fleet (home-ported at Sevastopol, Crimea), which is consistent with — though does not confirm — the CIS-36-50/Russian Navy family hypothesis raised above, possibly as a shore-to-ship link. Resolving the emitter's location further would require at least one receiver east of the target to break the current fan geometry; until then, this result stands as a corroborating but non-conclusive data point.
 |
| Figure 8 – Four independent TDoA fixes for the 11592.0 kHz signal, clustering in the northwestern Black Sea / Crimea-approaches area. |
Why the idling? Continuous idling of this kind can be attributed to several different operational, technical, or strategic rationales. It may serve to keep the frequency occupied, preventing other stations or commercial broadcasters from using the same channel. It also allows automatic receivers — presumably off-shore ones — to stay synchronized with the carrier's clock, ready to lock onto the traffic the instant real transmission begins. In the author's experience, however, this frequency has often been monitored for extended periods without any traffic being heard beyond the idling tone, though this alone is not sufficient to characterize the purpose of the station.
Alternative explanations. Other explanations for the extended idling remain equally speculative. One possibility, consistent with the TDoA-supported shore-to-ship hypothesis (Section 3), is that this behaves as a fleet broadcast, where actual data traffic is typically brief and occurs only when there is a genuine dispatch to send. It could also serve as a continuous propagation test on this specific frequency, or represent a reserve channel — loosely termed here a "ghost net" — kept active by a secondary control station while the main operational network routes traffic elsewhere, for example over primary frequencies offering better propagation at a given time.
The frequency neighborhood. The frequency picture in Figure 4 also raises questions that remain speculative, grounded only in the signals' own characteristics rather than in any further evidence: why would FSK broadcasts sitting so close together in frequency use different shift configurations, and could this reflect different intended recipients tuned to different channels, possibly with some form of channel prioritization? In the author's experience, a loose parallel exists with NATO FSK broadcasts [2], which commonly use 50/75 Bd with an 850 Hz shift — though under different encryption (KW-46 or KG-84), making the comparison structural at best rather than substantive.
Only future — and hopefully more fortunate — captures that include an actual dispatch transmission are likely to provide more definitive answers. Friends who may have recordings of this signal, particularly from nighttime hours or capturing an actual burst of traffic, are warmly invited to get in touch at tony.anselmi@gmail.com.
[2] https://i56578-swl.blogspot.com/p/nato-4481f-brassmrl.html
