Risk and safety
How to spot a nulled or cloned SMM panel
Last updated by The PanelCompare editorial team, 7 min read
What is the difference between a nulled panel and a cloned one?
A nulled panel is running pirated software. Somebody removed the licence check from a commercial panel script and redistributed it, and the redistributed build frequently carries additions the original did not have. A cloned panel is a business arrangement rather than a software one: two or more storefronts, different brands, one operator behind them.
They cost you different things. A nulled panel is a security problem, and its worst outcomes land on the operator and on anyone whose API key passes through it. A cloned pair is an information problem: it makes a market look more competitive than it is, and it means two of the options on your shortlist fail on the same day.
Why is a nulled script specifically dangerous here?
Because of what a panel holds and how the API specification handles secrets. A panel stores provider API keys and customer wallet balances, and the API v2 specification sends keys as long-lived bearer secrets in the request body with no signing, no nonce and no expiry. A backdoored panel is sitting in exactly the place the keys pass through, and there is no replay protection to limit what a copied key can do.
Cracked panel builds distributed on warez forums routinely include code that siphons those provider keys and user balances, and the operator running the panel is frequently unaware of it (PanelCompare domain research §1.6, 2026-09-06). The saving is a licence fee. The exposure is every key and every balance the panel touches.
For a buyer, this is an invisible risk on a normal-looking panel
A nulled panel does not look different. It has the same layout, the same catalogue and the same checkout, because it is the same software with the licence check removed. What differs is who else can read the wallet table, and that is not something a storefront reveals.
How can you tell a panel is running a pirated build?
Not with certainty from outside, which is worth saying plainly rather than pretending otherwise. What is available are correlated signals, and they are strongest in combination. The commercial platforms are recognisable, so the useful question is whether a panel is running something that looks like one of them without the things a paying customer would have.
- Script fingerprints without the platform: URL patterns like /services, /api/v2 and /childpanel, characteristic asset paths and favicon hashes that match a commercial script, on a panel with no vendor footprint anywhere.
- A very new domain paired with a mature, feature-complete panel. The features come free with a cracked build; the domain age does not.
- Missing features that the genuine platform includes by default, which is what happens when a cracked build is an older version.
- Theme and copy lifted wholesale from a vendor demo, including placeholder text nobody edited.
- No visible ownership, no company details, and a support channel that is a personal messaging account.
Treat these as reasons to keep your balance small rather than as proof of anything. The defensive posture is the same one that works against every other risk in this market: deposit the minimum, complete a test order, and do not leave a working balance on a panel you cannot identify the operator of.
Which panel software is legitimate, and what does it look like?
Knowing the real platforms is what makes a pirated build recognisable, because a nulled panel is a legitimate platform with the licence check removed rather than something built from scratch. The market has a small number of genuine vendors and a much larger cluster of resellers, theme shops and affiliate sites presenting themselves as vendors.
| Software | Model | What it tells you when you see it |
|---|---|---|
| Perfect Panel | Hosted SaaS, $50–$1,300/mo, scaling +$50 per extra 100,000 orders/mo | Founded 2013 and the de-facto premium standard: multi-provider forwarding, admin API, child panels, roughly 230 payment gateways |
| Smart Panel | One-time licence | The cheaper self-hosted alternative; reported to lack auto-refill management and the longest refill options |
| SocPanel | SaaS or script | Positioned as a simpler Perfect Panel alternative, with multi-language and currency conversion |
| JAP Script | Script | A budget clone of the JustAnotherPanel front-end; the resemblance is the product |
| Script and theme marketplaces | One-time scripts and Perfect Panel themes | Several of these domains are affiliate-review sites for the two majors rather than independent vendors; treat their comparisons as sponsored |
| Nulled builds | Pirated | Cracked Perfect Panel and Smart Panel builds circulating on warez forums, routinely carrying key and balance exfiltration |
Source: PanelCompare domain research §1.6, 2026-09-06. Perfect Panel pricing and feature set verified 2026-09-06.
The useful consequence is that the panel script determines the feature surface. Fingerprinting it from URL patterns, asset paths and favicon hashes lets you infer whether a panel supports drip-feed, subscriptions, child panels and refill automation without the panel telling you, which is also how a build claiming a feature set it structurally cannot have gives itself away.
How do you detect two panels run by one operator?
By looking for things that are expensive to write twice and cheap to copy once. Marketing copy, targeting lists, favicon and asset hashes, payment endpoints, TLS issuers and registrant details are all cheaper to reuse than to recreate, and reuse is what leaves the trail.
| Signal | How to check it | How strong it is |
|---|---|---|
| Near-identical marketing copy | Search a distinctive sentence in quotes | Strong; nobody writes the same paragraph twice by accident |
| Identical market or country targeting lists | Compare the country lists on both sites | Strong when the list is long and unusual |
| Shared favicon or asset hashes | Compare file hashes, not appearances | Strong |
| Same payment endpoint or merchant identifier | Inspect the deposit flow | Very strong |
| Same registrant, nameservers or TLS issuer | RDAP and certificate details | Moderate; shared infrastructure is common |
| Catalogues with identical odd min and max bounds | Compare the long tail of rows, not the popular ones | Moderate; may mean a shared upstream rather than shared ownership |
Source: Detection approach and observed cases from PanelCompare domain research §5.1, 2026-09-06.
Two concrete cases surfaced during this research. Two indexed panels, urpanel.com and whichpanel.com, share near-identical marketing copy and an identical nine-market targeting list. Two others, bulkfollows.com and rezzsmmpanel.com, share a named operating company. Presenting either pair as independent options inflates a buyer’s sense of choice and hides the fact that if one goes down, so does the other.
Why does a cloned pair matter if both panels work?
Because the whole point of a shortlist is uncorrelated failure. A buyer who keeps two funded accounts for redundancy, and picks two brands run by one operator with one upstream and one payment processor, has bought two copies of the same risk and paid two deposits for it.
It also distorts directories. A listing page showing twenty panels of which several are the same operator is describing a market that does not exist, and the reader has no way to see it. One competitor listing surveyed during this research went further and included a domain that is not even registered, which is a useful reminder to verify every directory you read, including this one.
What should an operator do about this?
- 1.Do not run a nulled build, for the plain reason that it is sitting on your provider keys and your customers’ balances and you cannot audit it.
- 2.If you have run one, rotate every provider key immediately and assume the balances were readable. The specification gives you no expiry to hide behind.
- 3.Buy the licence or use a hosted platform, and keep the vendor relationship visible on the site. Being identifiable is a trust signal you can produce cheaply.
- 4.If you operate more than one brand, disclose the common ownership. It is discoverable, and being found out is worse than the disclosure would have been.
- 5.Publish ownership and contact details of some kind. Every legitimacy signal that resists faking is one a real business can supply and a clone usually cannot.
Quick answers
What is a nulled SMM panel script?
A pirated build of a commercial panel script with the licence check removed. Redistributed copies routinely include added code that exfiltrates provider API keys and user wallet balances, often without the operator knowing.
Can I tell if a panel is running a nulled script?
Not with certainty from outside. The correlated signals are a commercial script fingerprint with no vendor footprint, a very new domain on a mature feature set, unedited demo content, and no identifiable operator.
What is a clone panel?
A second storefront over the same operator, catalogue and payment stack, presented as an independent competitor. It matters because two brands with one operator fail at the same time, which defeats the purpose of shortlisting two panels.
How do I check whether two panels are the same operator?
Search a distinctive sentence from one site in quotes, compare favicon and asset hashes rather than appearances, compare country targeting lists, and look at the deposit flow for a shared merchant identifier.
Every figure here is attributed and dated
Prices in this market move weekly, so a number without a capture date is decorative. Where this guide quotes a figure it names the source and when it was checked. If one of them is wrong, the correction process on the about page has a two-working-day reply target, and corrections are published with a dated note rather than quietly patched.