NTFZh

NTFZh is a Russian military communications station identified by its distinctive channel marker and associated message traffic.

NTFZh Summary
Country	Russia
Location	270th Communications Center (Military Unit 36203 - Goliaf Transmitter), Nizhny Novgorod (Нижний Новгород)
Callsigns	NTFZh (official station recipient) NTFV (used in morse and digital) Proverky24 (station ID, heard in a leaked phone call "Ya Proverky24")
Airdate	July 2026
Frequencies	4844 kHz (Primary) See detailed list below
CW freqs	4844, 4937 kHz
Power	300 W – 300 kW (estimated, varies by transmission state)
Antennas	VGDSh Dipole
Status	Active (irregular schedules, typically between 10:00 and 02:00 UTC)

Overview & Location History

The station was initially suspected to be operating from the Leningrad Oblast, with early direction-finding estimates placing the transmitter somewhere between Saint Petersburg and Kirov. Further TDoA investigations later suggested a possible location near Lodeynoye Pole (Лодейное Поле), potentially associated with the 334th Radio-Technical Regiment (Military Unit 96848). This attribution remained unconfirmed.

As of 01/09/2026, the suspected transmitter location and associated personnel have been revised. The station is now believed to be operated from the 270th Communications Center (Military Unit 36203) in Nizhny Novgorod (Нижний Новгород), Russia, along with updated personnel and organizational attributions. This new attribution remains a working assessment rather than a definitively confirmed identification.

Since relocating, the station has exhibited unusual activity, including propaganda broadcasts and digital modes such as CIS-12, CIS-20, and various modems. Furthermore, its overall behavior and activity patterns show strong similarities to the Russian military station FGKT.

Message Structure & Format Examples

All branches of the Russian Armed Forces use standardized formats for voice and Morse code radio messages. Depending on the traffic type, messages follow structured preambles and specific tactical formats (such as Monolit or Uzor).

1. Standard Preamble & Urgency Levels

Non-ordinary messages are typically preceded by an urgency level identifier (*Samolet*, *Raketa*, *Vozdukh*, or *Monolit*) and a strict preamble structure:

Preamble Components: Serial number -> Group count -> Day of the month -> Moscow time -> Serial number confirmation.
Routing Prefixes: Origin callsigns are preceded by ot (voice) / FM (Morse), and destination callsigns by dlya (voice) / FOR (Morse). If the field following DLYA is left blank, it indicates a broadcast message intended for all stations on the network (or currently uncertain).

2. Monolit Format Specification

Monolit messages take the following strict format:

Structure: [Recipient Callsign] + [5-digit group] + [Code word] + [Two 4-digit groups] ...
5-digit group: Connected to the recipient(s), configured either as a single recipient followed by a single/multiple 5-digit groups, or multiple recipients followed by an equivalent amount of 5-digit groups.
Content: The code word usually addresses an envelope with instructions, with the accompanying pairs of 4-digit groups forming the core message to be decoded using that given envelope.
Zone-covering messages (Зоны): Messages using this exact Monolit format but carrying no actual operational meaning (often logged as background or dummy traffic).

3. Recorded Examples of All Observed Message Types

Standard Monolit Voice Messages:
- 05/08/2026 (4774 kHz):
  - Cyrillic: `НТФЖ 52156 НАТИЖ 0100 4638`
  - Latin: `NTFZh 52156 NATIZh 0100 4638`
  - Structure Analysis: Station ID (*НТФЖ*), recipient callsign/5-digit group pairing (*52156*), followed by the recipient/code section (*НАТИЖ*) and operational groups (*0100 4638*).
- 22/08/2026 (4844 kHz):
  - Cyrillic: `НТФЖ ТОД3 86106 БИМБАЛОКЗ 0870 3256 Приём`
  - Latin: `NTFZh TOD3 86106 BIMBALOKZ 0870 3256 Priyom`
  - Structure Analysis: Monolit format starting with station ID, recipient callsign (*ТОД3*), connected 5-digit group (*86106*), code word (*БИМБАЛОКЗ*), and two coordinate/content 4-digit groups (*0870 3256*).

Special / Anomalous Voice Message:
- 16/08/2026 (4774 kHz):
  - Cyrillic: `НТФЖ 50261 4774 КТШЦ 5206 0824` *(Note: contained internal timestamp/date contradictions)*
  - Latin: `NTFZh 50261 4774 KTShTs 5206 0824`
  - Structure Analysis: Station ID (*NTFZh*), unit/recipient pairing (*50261*), frequency reference (*4774*), code word (*KTShTs*), and anomalous parameter groups (*5206 0824*).

Voice Test Counts (Proverka Mikrofona):
- 04/08/2026 & 22/08/2026 (4774 / 4844 kHz):
  - Cyrillic: `НТФЖ 1 2 3 4 5 6 7 8 9 10 Проверка Микрофона Приём`
  - Translation: Station ID — Numerical test sequence (1 to 10) — Microphone Check — Over.
- 02/09/2026 (4844 kHz):
  - Cyrillic: `НТФЖ 1 2 3 4 5 6 7 8 9 10 0 Проверка Микрофона Приём`
  - Translation: Station ID — Extended numerical sequence (1 to 10, ending in 0) — Microphone Check — Over.

Morse / DLYA Telegraphy Messages:
- 22/08/2026 (4844 kHz):
  - Cyrillic / Morse text: `ХХХ ХХХ ДЛЙА ДЕ НТФВ == 54987 МОМБАЛКХ МОНТУ МОБУТУ КОНТО АОРИС == 5640 8975 K`
  - Latin transcription: `XXX XXX DLYA DE NTFV == 54987 MOMBALKH MONTU MOBUTU KONTO AORIS == 5640 8975 K`
  - Structure Analysis: Attention signal (*XXX XXX*), blank destination field following *DLYA* indicating a general broadcast to all stations (or uncertain recipient), origin separator (*DE*), variant callsign (*NTFV*), separated by double signs containing encrypted code groups, closing parameters, and invitation to transmit (*K*).

Digital Modes & Telemetry Transmissions:
- RDFT & RTTY Encrypted Data: Automated teleprinter bursts logged during scheduled broadcast windows (e.g., 24/08/2026 on 4844 kHz).
- CIS-12 (T-230) Encrypted Traffic: High-grade multi-tone tactical digital data streams observed following the Nizhny Novgorod relocation (e.g., 01/09/2026).
- CIS-20 Encrypted Traffic: Complex digital data packets deployed during unstable propagation and hardware tuning tests (e.g., recorded on 02/09/2026).

Technical Specifications

Operating Frequencies

The station has been observed operating on a wide array of frequencies, adapting to propagation and different transmission sites:

Primary active frequency: 4844 kHz (suspected to be primarily used for nighttime operations)
Frequently active (Non-primary):
- 5368 kHz (Generally active during the day; suspected to be tested as a future primary daytime frequency)
- 7134 kHz (Mainly used during the day, but occasionally active at night; this frequency notably appeared following the station's relocation to the 270th Communications Center)
Historical / Periodic / Alternate frequencies: 3862, 4316, 4584, 4744, 4761, 4770, 4774, 4781, 4804, 4937, 4955, 5071 kHz

Signal Characteristics

Modulation: Normally transmitted in USB, occasionally with the carrier suppressed, or featuring a residual/full carrier characteristic similar to H3E.
Bandwidth: Approximately 200 × 3500 Hz, combined with a very high AGC level.
Markers: Utilizes multiple channel-marker configurations, with patterns varying between transmissions. Recent telemetry shows tuning tests shifting the standard marker tone from 200 Hz to a modified 230 Hz configuration, alongside multi-frequency markers (e.g., 4770 and 4774 kHz).

Recent Notable Activity & Anomalies

Based on recent observations (July – September 2026), the station has exhibited highly unusual behavior and operational instability:

Music & Anti-Pirate Jamming: Following a pirate attack on 4844 kHz in late August 2026, the station utilized high-power jamming featuring iconic Russian songs, notably the rock version of "Red Army is The Strongest" by LYUBE.
Unusual Komanda & Callsigns: The station has been logged calling out the callsign DDDDD in a *Komanda* context. Because *DDDDD* is typically used for radiograms rather than command messages, this practice is highly irregular.
Digital Modes & Telemetry: Aside from standard voice messages (Monolith, DLYA in Morse) and pip markers, the station frequently deploys digital data modes, including RDFT, RTTY, CIS-12 (T-230), and recently CIS-20. Background elements like 3-tone clocks and 800 Hz tones have also been recorded.
Inter-Station Activity & ROJY: The station frequently interacts with or is observed alongside other military stations—most notably ROJY, which has been logged operating directly over NTFZh frequencies.
Multi-Site Transmissions: Observations indicate the use of multiple transmitter sites simultaneously. Signals have been logged switching between the main TX, an older location, and a secondary location suspected to be in the Southern Military District of Russia.
Equipment Malfunctions: The station frequently suffers from technical issues, including severe 50 Hz ground loops, marker instabilities, rapid dropouts/breakdowns, and unintentional transceiver noise (open microphones).
UVB-76 Emulation: The station has occasionally adopted marker styles identical to the legacy UVB-76 markers from the 2005-2010 era, as well as deep low-tone buzzer sounds.

For detailed, daily logs of these events, see NTFZh:Activity.

Possibly linked stations:

Connections with NZhTI (The Buzzer)

NTFZh has periodically displayed links to NZhTI (The Buzzer, operating on 4625 kHz). July and August 2026 saw several notable interactions, including two-way communications and network checks:

NZhTI Connection Event	Description
NTFZh microphone leak	Microphone Leak: NTFZh leaked audio (possibly via phone line) requesting Komanda from NZhTI under the callsign Vulkan for 4625 kHz.
UVB-76 old marker usage	Legacy Marker: NTFZh utilizing a historical UVB-76 marker format exactly on the hour (HH:59).
NTFZh Calling TOD3	TOD3 Transmission: NTFZh specifically calling out TOD3 traffic in a Monolith message.

Page Metadata

Last Updated: 02/09/2026 - 16:30 UTC+2