update... its not apache htaccess protected sites as I setup and tested a few myself. It appears to be Microsoft IIS6+ password protected sites as it turns out thats what they are runnig, coldfusion may or may not be involved as part of this. I'm waiting for more info and am going to setup a test windows IIS server for testing further.
CTO, Convergent Information Security Solutions, LLC
https://www.convergesecurity.com
Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.