11592.0 kHz - Unid FSK 41.6 Bd/200 Hz shift (CIS/Rus FSK family?)

An unidentified FSK 41.6 Bd/200 Hz signal on 11592.0 kHz (CF), reminiscent of — but not rather matching — the Russian Navy's well-known T-600/CIS-36-50 family. inactive an open case after days of monitoring and a first TDoA attempt.

1. Signal Parameters
Among the FSK utility signals monitored on HF, a transmission on 11592.0 kHz (cf) stands out for its distinctive parameters: about 41.6–41.67 Bd with a 200 Hz shift between mark and space tones (Figure 1). The 200 Hz shift value is reminiscent of T-600, a proprietary FSK broadcast strategy utilized by the Russian Navy (also known as BEE-36 or CIS 36-50), which is documented to usage a 200 Hz shift at more than 1 baud rate [1]. Neither of these documented rates matches the ~41.6–41.67 Bd observed here, nor does any another published T-600 configuration. At most, then, the shift value can be treated as a household resemblance to the T-600 strategy alternatively than a affirmative identification.

Figure 1: Top: waterfall/spectrogram of the two-tone FSK carrier. Bottom: period/pattern analysis confirming a symbol rate of 41.66 Bd (Br) and a measured shift dF = 201.42 Hz

A further characteristic emerges erstwhile examining the phase relation across successive shifts: the phase of each speech is not preserved from 1 occurrence to the next, and this holds independently for both the space speech (Figure 2) and the mark speech (Figure 3). This is consistent with the 2 tones being generated by 2 independent, free-running oscillators alternatively than a single voltage-controlled oscillator (VCO) switching frequency while preserving phase continuity — a strategy under which no phase discontinuity would be expected at the shifts.

Figure 2: Persistence display of the space speech across successive shifts. The Δθ arrows mark the phase offset between successive shifts, showing that phase is not preserved.

Figure 3: Persistence display of the mark speech across successive shifts, showing the same deficiency of phase continuity.

Figure 4 – Frequency vicinity snapshot: 11592.0 kHz idling alongside 2 confirmed Russian BEE/50 circuits actively carrying crypto traffic, at 11598 kHz (200 Hz shift) and 11603 kHz (250 Hz shift).

The bulk of the observed traffic consists of idling — the regular "01"s sequences besides known as eversals. Transmissions begin around 0800 UTC, with no preceding call-up or announcement (Figure 5, top), and proceed for about 10 hours, until about 1800 UTC, ending as abruptly as they begin, with no sign-off (Figure 6). The on- and off-times are not perfectly fixed: variations of more than a minute have been observed on repeated occasions, which is consistent with — though does not confirm — manual start/stop of the transmission alternatively than a strictly clock-driven schedule. The idling phase is occasionally interrupted by brief N0N(1) transmissions on the space-tone frequency, before resuming the average alternating pattern (Figure 5, bottom).

Figure 5: Top: onset of transmission with no preamble. Bottom: idling briefly interrupted by an N0N transmission on the "space" requency.

Figure 6: End of transmission: the reversals pattern cuts off abruptly into noise, with no sign-off (recording started 17 September 2026, 17:35:34 UTC; the .wav file was later trimmed to isolate the transmission's closing segment).

Very short N0N interruptions were besides recorded during any monitoring sessions (Figure 7).

Figure 7: Reversals series briefly interrupted by N0N transmissions on the space frequency.

Nighttime monitoring (beyond the 1800–0800 UTC window) has so far only been carried out on a fewer occasions but without receptions of the signal of interest. Given that this null consequence is consistent with the daytime-only agenda already established above, it does not by itself indicate a separate nighttime frequency. 1 plausible explanation, common to HF fixed/military links, is that 11592.0 kHz (cf) could service as the daytime channel with a distinct, as-yet-unidentified frequency utilized at night(2). No candidate night frequency carrying the same modem signature has been found so far, so this remains an open hypothesis for future monitoring alternatively than an established fact.

3. Attribution Assessment
Geolocation. 4 independent TDoA runs were carried out utilizing a European KiwiSDR receiver network (nodes in/near Germany, Poland, the Slovakia/Hungary border, Croatia, Italy, and Greece), with no receiver coverage east of the target. Given this geometry, all baselines approach the emitter from broadly the same direction, producing hyperbolic lines of position that intersect at shallow angles — which limits precision along that bearing.
Results. The 4 fixes (44.40N/32.60E, 44.80N/30.80E, 43.60N/30.40E, 45.00N/32.20E) cluster within about 150–230 km of each another (Figure 8), in the northwestern Black Sea / confederate Ukraine coast / Crimea-approaches area that overlaps the operating theatre of Russia's Black Sea Fleet (home-ported at Sevastopol, Crimea), which is consistent with — though does not confirm — the CIS-36-50/Russian Navy household hypothesis raised above, possibly as a shore-to-ship link. Resolving the emitter's location further would require at least 1 receiver east of the mark to break the current fan geometry; until then, this consequence stands as a corroborating but non-conclusive data point.

Figure 8 – 4 independent TDoA fixes for the 11592.0 kHz signal, clustering in the northwestern Black Sea / Crimea-approaches area.