Want to know who’s direct-linking your images? You need access to your domain’s Control Panel for the Webalizer Stats and Raw Access Logs. If you’re hosted, ask your host to send them to you.
This first method can be used if you dont have a replacement image set for the direct-linkers. You need to remember that every time someone views an image it’s classed as a hit. So if you have lots of hits from a site you’ve never heard of, they could either have a link to your site or are direct-linking one of your images. The Webalizer Stats dont usually give a specific URL that the hits are coming from, so this is where your Raw Access Logs come in
Open your Raw Access Log file. If you’ve spotted an unfamiliar site giving you lots of hits, press ’search’ or ‘find’ and type in the URL. When you find the link, look above it for the file that they are linking too. If it’s a HTML file, they are just plugging your site. If it’s an image (GIF or JPG, etc) then they’re direct-linking. The Raw Access Logs will also specify the exact location that the person has put your image on

This second method makes searching a lot quicker. This is if you use a replacement image stored on your domain webspace. As you can see from the image above, I called my replacement image nolink.gif so whenever that comes up, someone is definitely direct-linking!
Open your Raw Access Log file and press ’search’ or ‘find’ and type in the name of your replacement image e.g.nolink. Look at the line above where your replacement image is to see exact who is direct-linking and what image they’re using.