# SMM panel software and infrastructure survey — 9 September 2026 The dataset behind . Eighty-four SMM panel domains, fingerprinted between 20:26:05Z and 20:38:54Z on 2026-09-09. Seventy-six answered. Of those seventy-six, **fifty-four run one vendor's software** — the same asset host, the same build artefacts, and in forty-nine cases the same hard-coded vendor captcha key sitting in the page source. Forty-four of the eighty-four resolve inside a single OVH `/24`. No account was created, no order was placed, no form was submitted, nothing behind a login was requested. Four public URLs per host — `/robots.txt`, `/`, the public catalogue, `/favicon.ico` — one request per host per two seconds, sent as `Novamya-Research/1.0 (+https://novamya.com/about/)`. Two of the eighty-four — `smmlaunch.com` and `adderpanel.com` — are operated by the company that publishes Novamya. They are in the sample and labelled, because leaving them out would hide the one relationship this data can actually verify. They are not exceptions to the finding: both are tenants of the same vendor software, both sit in the same `/24` as forty-two other panels, and both carry the same vendor captcha key as forty-seven others. ## Files | file | what it is | |---|---| | `panels.tsv` | the 84 candidates: slug, domain, disclosed relationship, and where the candidate came from | | `fingerprints.csv` | one row per panel, one column per fingerprint dimension — software, tenant, infrastructure, catalogue shape, currency, payments, support | | `clusters.json` | the derived groupings, each with the evidence behind it and a plain statement of what that evidence licenses | | `stats.json` | every aggregate figure the article quotes | | `fetchlog.tsv` | one row per fetch: URL requested, URL after redirects, HTTP status, bytes, `Server`, `X-Powered-By`, SHA-256 of the body, UTC timestamp | | `infra.jsonl` | one row per domain: A records, reverse DNS, ASN, nameservers, TLS issuer, validity and SAN list, with its own timestamp | | `pages/*.home.html.gz`, `pages/*.services.html.gz` | each page exactly as it was served to us | | `pages/*.robots.txt.gz` | each host's robots.txt, so our reading of it can be checked | | `pages/*.headers.txt.gz` | the full response headers for every retained page | | `harvest.py` | the collector. It enforces the robots.txt rule and the rate limit in code | | `analyse.py` | offline. Run it against `pages/` and it reproduces `fingerprints.csv`, `clusters.json` and `stats.json` without touching the network | | `method.md` | how the 84 were chosen, what was excluded, what each piece of evidence does and does not support | ``` python3 analyse.py # pages/ + fetchlog.tsv + infra.jsonl -> the three published files ``` ## What this is not **It is not an ownership investigation, and the data does not support one.** Fifty-four panels running the same software means one vendor sold fifty-four licences. This dataset contains a specific reason to think those are fifty-four different customers: each of the fifty panels whose vendor tenant folder we could read has **its own distinct tenant id**. Fifty panels, fifty separate accounts, no overlap. Shared hosting says the same thing — a multi-tenant platform puts its customers on the same addresses by design. **A shared TLS certificate would have been the strong evidence, and there isn't one.** Every certificate here covers one domain and its `www`. That absence is reported, not dropped. **Shared catalogues were weaker than we expected.** Across 903 pairs of panels with a readable catalogue, the highest name overlap is 0.47, between `smmcost.com` and `smmbind.com`, sharing 3,064 verbatim service names. One pair exceeds 0.30. At the threshold set in advance, 0.60, there are zero clusters. Two catalogues sharing thousands of identical strings is consistent with a shared upstream supplier and equally consistent with one panel importing another's price list; this survey measures the overlap and stops there. **Nothing here is about delivery.** Not one order was placed. No named business is accused of anything. The finding is about the structure of the market, not the conduct of any company in it. Eight of the eighty-four could not be read at all: six returned `403` to a self-identified research agent and two refused the connection. They are named in `method.md`, kept as rows in `fingerprints.csv`, and counted in the denominator of "84 candidates" and out of the denominator of "76 we could read". A panel that refused us is data. ## Licence Free to reuse with attribution to novamya.com.