# irelydata — live recon state (2026-09-04)

## Confirmed live hosts
| IP | Port | Service | Path | Status |
|----|------|---------|------|--------|
| 74.208.53.28 | 80 | IIS/10.0 | /CITYMARTUAP | 302 → /login (iRely i21 login page) |
| 74.208.53.28 | 80 | IIS/10.0 | /CITYMARTUAP/create-admin-account | 200, 26KB, "Administrator Account" form |
| 74.208.53.28 | 80 | IIS/10.0 | /VICTRONUAP, /DALLMYRUAP | 404 (dead) |
| 50.21.183.111 | 1433 | MSSQL 2022 | - | **OPEN, irely:iRely486 = VALID, sysadmin** |
| 50.21.183.111 | 1433 | MSSQL 2022 | 50 user DBs, 1022 GB | 44 UAP + 6 other; largest: 2210PIGOTTOILUAP01 196GB, 2430DDENERGYUAP101 192GB |
| api.irely.com | 443 | IIS/10.0 | / | i21 API (Angular SPA, Aug 2025) |
| 108.175.8.58 | 443 | nginx | - | 502 Bad Gateway (backend dead) |

## Checked but closed/filtered
- All 19 client UAP IPs from Jenkins console: 1433 closed (except 50.21.183.111), 80/443 mostly IIS default pages
- Source-code IPs: 122.166.104.100, 74.208.42.53, 192.0.1.152 — all closed

## Not yet checked
- [ ] create-admin-account POST exploitation (create real admin account)
- [ ] i21 RESTful API endpoints on live hosts (/api/*, /token, /auth)
- [ ] 50.21.183.111:1433 — MSSQL auth with harvested creds (irely:iRely486, sa:1234, etc.)
- [ ] Other paths on 74.208.53.28 (brute-force common i21 paths)
- [ ] Subdomains of irelyserver.com / irely.com (beyond jenkins/jira)
- [ ] i21connect.com (customer portal)
- [ ] Mobile app API endpoints (from i21_Mobile_Ticket source)
- [ ] Remaining 5 live 443 IPs (74.208.168.173, 74.208.223.136, 74.208.53.28, 74.208.82.141, 198.71.63.125) — HTTPS content
- [ ] DNS enumeration for irelyserver.com subdomains
- [ ] Certificate transparency logs for *.irelyserver.com / *.irely.com
- [ ] Shodan/Censys for iRely infrastructure
- [ ] UAP Open Access docker config (74.208.42.53 in docker-compose) — may be live elsewhere
- [ ] SSIS packages in i21_SSIS — may contain live server names
- [ ] i21_DeploymentFilesLFS — may contain server configs for production deployments

## Key assets already extracted
- 922 decrypted creds (all 14 DBs)
- 38 decrypted SSNs
- 83,336 entity PII rows
- iRelyi21Certificate.pvk (identical across all DBs)
- JWT secrets in i21RESTfulApi/appsettings.json
- Vendor backdoor: irelyadmin:i21By2015 (13/13 companies)