I got a different staging server as my #2 result. This is password pretected like OP suggested. https://preview.us.coca-cola.com/products/coca-cola-flavors/cher

I got a different staging server as my #2 result. This is password pretected like OP suggested. https://preview.us.coca-cola.com/products/coca-cola-flavors/cherry-vanilla https://preview.us.coca-cola.com/products/coca-cola-flavors/... The link OP shared is open to the public to me. https://staging.us.coca-cola.com/products/coca-cola-energy/cherry https://staging.us.coca-cola.com/products/coca-cola-energy/c... I would think that even if these weren't showing up on google that people would be able to find the subdomains through dns. They should probably move these to an internal domain so they are harder to find.