I'm seeing in my access log a number of request very suspicious:

/i
/im
/imaa
/imag
/image
/images
/images/d 
/images/di
/images/dis

They part from a known resource (in the above example /images/disrupt.jpg).

All comming from same IP. Requests varies from 1/sec to 10/sec, seems somewhat random.
It's obviously they are trying to find something and seems they are using a script.

How do I block this kind of behaviour? I though of blocking the IP request, at least for a given time. Keeping in mind that:

• Request intervals seems legitimate (at least I think so).
• I don't want to end blocking a search engine bot, which may find 404 urls too (and that's a different problem, I know). ¿Do they use always same IP?