New Picscout IP range to block.

[lucia]

I discussed blocking image bots at my blog. DukeC a commenter asked me if my script blocked the picscout add-on which they are marketing as a way for people to identify images for sale.  Of course, the add-on also detects  images and reports back to picscout.   That visitor installed the add on, and hit a post containing images telling me his IP and user agent.  Four seconds after he hit with his IP and with the addon installed  short order, my logs showed a visit from IP 72.26.211.129. My script autobanned IP 72.26.211.129 which I suspected was an IP reporting back to picscout.

I then repeated this at a domain I control that does not run my protective script and so was not blocking IP 72.26.211.129. In my experiment, I saw a hit from 72.26.211.130 4 seconds after I loaded an image with the picscout add on installed.  I am pretty convinced these are reporting back to picscout.

I recommend those who want to prevent visitors from reporting back to picscout to
a) block the IP range 72.26.192.0 - 72.26.223.255 and
b) periodically use the image ad on to load an innocent image at their blog so as to monitor hit that follows.  Repeat this a few times to learn the current range of the picscout IPs used by the image addon.

For now, block
United States New York Voxel Dot Net Inc  IP range
NetRange:       72.26.192.0 - 72.26.223.255

I'm going to cloudflare to block this right now.

[Robert Krausankas (BuddhaPi)]

Good discovery Lucia, I did a quick IP records search , and it leads back to a hosting company called voxel.net, doing another quick searck of Voxel.net + Picscout yieded some interesting results, that I am currently digging thru, however the below jumped right out at me immediately.

http://www.dailychanges.com/411images.org/

I will be doing a little more research on tis later..

FYI - voxel.net is out of New York, which makes me wonder if Getty/PS have moved their operations from Israel, or if they are now operating both here and abroad..

[lucia]

I've implemented a strategy to watch for IP's related to the toolbar. The script and method will be available publicly soon.  People will be able to implement it a couple of different ways. (The most effective is using Cloudflare. That's good for bloggers but I'm not sure it's good for others.)

See.... I told someone (Soylent?) he shouldn't be so sure the various bots are corrected just because he banned bezeq.   I am so p*ssed at getty that I am being thorough.

[Robert Krausankas (BuddhaPi)]

So far from what I've seen, I thin k they are still running the software portion out of Israel, but i've banned the new ips as a precaution as well. were you able to identify the user agent??

[lucia]

There was no user agent. No referrer.  What you see is this:

1) Person visits with add-on installed.
2) You see that persons hit. That hit shows their UA and IP and generally speaking a referrer corresponding to the post on which the image appears.
3) roughly 5 seconds later, you see a hit from a different IP with a blank user agent and blank referrer. That IP is the one I mentioned above.   

Because that IP is from a cloud, I can't be certain that's the only IP range for these images. I'm doing a test using domains under my control. Should I see other IPs, I'll report.  Of course I can't be sure my test will catch all IP ranges, but if I do see others, I can report that.

[lucia]

I should add: I wouldn't be at all surprised if picscout is running somethings out of israel and some at the US IPs.  This is the add on:
http://www.picscout.com/faq/imageexchange-faq.html#IE1

I'm guessing, but likely, the business plan is
1) User who wants to find images to buy installs add on.
2) User surface for images. In the process, the visit lots of websites displaying images. When they hit, you see their IP and ua.  The picscout add-on sends the URI of all images to picscouts server.
3) The picsout server then hits the images to see what they look like and compares those to images in its database; this leaves the URI's I reported above at the website hosting the image.  The server then sends back information to the user's browser.  This information is displayed in the browsers sidebar. It includes a link to the web site selling the matching image.

So far-- all hunky dory.  But of course, in the meantime, picscout has collected information that-- if they wish-- they can use to discover that a particular site is hosting a copyright violation.   So, one might want to block these new IPs. But it's not the same software we were seeing before, and evidently not the same IPS.

[lucia]

I've realized that to do a good experiment, it would be useful if I found volunteers with other websites and blogs.  Failing that, I'm going to need volunteers from various parts of the country and world to install the add-on and load an particular image link.  The latter might be better-- and ideally, they tell me they are going to do it so I can know they hit the image link.  After you hit, you can remove the add-on from your browser. I advise it so you aren't providing picscout data they can convert to their profit.

Anyone who want to help out let me know.

[SoylentGreen]

Good work by Lucia.  Nice!!

We shouldn't be surprised that PicScout's application is some sort of spyware.

The question that comes to mind is, does the EULA (license) of the PicScout application explain what the program actually does?
In addition, is a program like this illegal if includes what appears to be spyware?
Should an infringement be detected by this (illegal?) application, would it be a court defense that the discovery was made by illegal means?

I usually keep most applications from "calling home" by using a firewall unless absolutely necessary.

BTW, what's the actual name of this application?
It would be a good idea to reference it here for search engine purposes...

S.G.

[lucia]

By an interesting coincidence, I went to
http://picscout.com/imageexchange/apps/download.html
and tried to read the terms and conditions. The page was "missing" initially (404 error), so I loaded the google cache which shows a version from Oct 12, 2011.
http://webcache.googleusercontent.com/search?q=cache:BmPTJaJqi7wJ:www.picscout.com/plugin/terms.html+&cd=1&hl=en&ct=clnk&gl=us&client=firefox-a

I revisited the terms page-- I'm getting a 500  error starting with:
The server encountered an internal error or misconfiguration and was unable to complete your request.

The terms and conditions in cache state-- among other things--

10. Governing Law

This Agreement and the relationship between you and PicScout is governed by the laws of the State of Israel without regard to its conflict of law provisions. You and PicScout agree to submit to the personal and exclusive jurisdiction of the competent courts of Tel Aviv-Jaffa, Israel, and no other courts shall have any jurisdiction whatsoever in respect of such disputes arising in connection with this Agreement. The United Nations Convention on the International Sale of Goods does not apply to this Agreement.

and also

(iii) Any information supplied by PicScout or obtained by you through your Use of the Product, as permitted hereunder, may only be used by you for the purpose described herein and may not be disclosed to any third party or used to create any software which is substantially similar to that of PicScout;

So, I may need to rely on web bugs distributed on blogs and sites to monitor for IPs. That way none of us need to figure out precisely what that agreement (or any future ones) bind anyone to.  Anyone who would like to volunteer to host a web bug or let me place a web bug I host on their site or blog let me know. 

[lucia]

It is the Picscout Image Exchange add on (or extension). It is also available for internet explorer.  And it might be called an app.  Getty writes "With ImageExchange, stock agencies and photographers promote their content wherever it resides online".

Picscout is suggesting people surfing use Google or Yahoo as follows: "Users of the add-on use search engines like Google and Yahoo Images to ID images from more than 150 stock agencies and photographers".  But the fact is, if a consumer visits Google or Yahoo, then the consumer will  likely visit the site where the image rather than only view the thumbnail hosted at Google or Yahoo.

Picscout also has  a product called ImageTracker.

As for being spyware: Well... it has to report back to Picscout to work.  But I suspect the only thing Picscout doesn't want to spy on the person who installed the add on. They just want to enocurage the to buy images from their customers and also possibly use crowdsourcing to discover copyright infractions. The former is their stated business plan. The later...well.. if I were Picscout, I'd be doing that -- provided it's legal. I suspect it is legal.

But that doesn't mean I can't block them. That's legal too! 

[lucia]

Other information: The front page of Picscout:
http://www.picscout.com/
has a button that permits downloading without ever mentioning a user agreement.  I went back because I generally read those before downloading and didn't remember seeing one prior to today when I googled to find the specific add-on page.

[SoylentGreen]

Good info as always...

Yeah, I don't think that I'll be using that application any time soon.

Besides, PicScout's partners are too expensive.
At one time, it was perceived that a "cool" website made more money.
Now, it's more important that the site is easy to find and navigate.
Additionally, companies need to make/sell what the customers want, at the best price, and with the best deals on shipping.
I also think that "real estate" on a web page is best used for photos of product, and info about features/benefits.

The high-priced stock photo market is dying.
PicScout's the box they're going to bury it in.

S.G.

[lucia]

I actually like picscouts tool. But what's going to happen is that people will find images and buy the cheaper ones.  Whether the stock companies selling 20 downloads for $3/month will hire on picscout to help people find the images and subscribe to the service I don't know. But for many blogs or businesses, 20 download a month that can be displayed would be precisely the right price.