How to prevent scan by drupalxray
You can look at deploying a site and scrubbing it of files like CHANGELOG.txt/INSTALL.txt automatically. Other things, like removing the meta generator tag in the head also can hide that it is Drupal, but nothing is bulletproof. For example, typing 'Drupal' in the browser devtools window is another way to tell if a site is Drupal or not (in most cases). You could also try banning requests originating from that domain/service at the server level.