Comment by debian3

The usual playbook is they rename it a few times first, then they kill it.