First, you need to be aware of the entities involved in such set-ups. From your explanation, it appears that you are interested in the innards on the Application Server end. Those Applications still have to engage PRSPs for connection to the Mobile Networks.
Mobile Providers
---------PRSPs
| SMS-C/ |<------http------> APP1
| USSD-GW |<-----xmlRpc-----> APP2
HANDSET <----- ss7 ----> | SERVER |<------smpp------> APP3
| or |<------vXML------> APP4
| SWITCH |<---witchcraft---> APP5
---------
In this case, I'd say scout for the business clients to the PRSPs . Of course some of the apps are hosted in-house by the Mobile Providers, and I suspect that some PRSPs may also double up as app-server owners.