I've done something similar once to find Dell iDRAC [0] and Exchange Outlook Web App [1] instances open to the internet. Just goes to show how forgetting a simple robots.txt (if it's even an option) can expose something you don't want, even if it's password protected.

[0] https://www.google.com/search?q=%22Type+in+Username+and+Pass...

[1] https://www.google.com/search?q=intitle%3A%22Outlook+web+app...