Rippers 0 browser - suspicious activity

2 visitors to my site from a Rippers browser - are they stealing content?

[lynn_b]

I noticed in my stats yesterday morning 2 visitors to my site, both from Dubai. They initially entered the site with IE 6.0 browser, then in subsequent page visits from the same IP, the browser is noted as Rippers 0.

Any idea what they were doing?

I'm concerned because another site of mine was pirated a while back, which was traced to this same Ripper browser issue.

Thanks anyone who can shed some light on the matter.

[edited by: tedster at 7:11 pm (utc) on Oct. 5, 2009]

[tedster]

Plenty of sightings around the web for this user agent, but it doesn't appear in the big list at [user-agents.org...] Still, the complaints I found see this user-agent as a nuisance and show it coming from IP addresses all over the globe, so I suspect it is used by someone's site ripper script.

The fact that the user-agent changes during the session does look VERY suspicious. I'd probably block it at the server level, but monitor the IP addresses that already show this UA. Since it's changing, there's likely some other funny business going on, too.

[lynn_b]

Thanks tedster. Do you mean to block the IP address at the server level, or can I block the user-agent itself?

[tedster]

You can block the user-agent, but you already know that the user-agent is shifting - so I'd probably block the IP address.