Jumping in on this older post because I’ve been thinking about this same question. When bots scan for vulnerabilities, they look for code patterns like function calls or database queries, not the module’s filename. So renaming doesn’t change the exploitable logic. Curious—have you tried any other obfuscation methods that actually work for you?