Is anyone trying to get the page? It'd only take ~18,000 attempts to find the page with some script that automatically visits the page changing the text of the XXX in XXX.php and stops after it detects actual content or something if you just run through all possibilities...the odds that way are far better than trying to bust encryption(this case is special though, so it might be easier to crack than normal since it's only 3 alphabetical characters). Then again, it definitely isn't optimum to do by attempting all possibilities for several reasons, but it's the only way I know of.