public class ImageGuardHandler : IHttpHandler
     {
         public void ProcessRequest(System.Web.HttpContext context)
         {
             HttpResponse response = context.Response;
             HttpRequest request = context.Request;
             string imagePath = null;
             if (request.UrlReferrer != null)
             {
                 if (String.Compare(request.Url.Host, request.UrlReferrer.Host,
                 true, CultureInfo.InvariantCulture) == 0)
                 {
                     imagePath = request.PhysicalPath;
                     if (!File.Exists(imagePath))
                     {
                         response.Status = "Image not found";
                         response.StatusCode = 404;
                         return;
                     }
                 }
             }
             if (imagePath == null)
             {
                 imagePath = context.Server.MapPath("~/Images/NotAllowed.jpg");
             }
             response.ContentType = "image/" + Path.GetExtension(imagePath).ToLower();
             response.WriteFile(imagePath);
         }

         public bool IsReusable
         {
             get { return false; }
         }
     }

<httpHandlers>
 <add verb="*" path="/images/*" type="ImageGuardHandler"/>
</httpHandlers>