So I have an AD Domain / RDP honeypot that I leave on the internet. I rebuilt it and forgot the administrator account had a weak password (literally password). Today, the account was disabled, I realized immediately that I accidentally put it online.