Add multiple content on mutliple match in DATA RESPONSE

I tried the following rule and it works fine for me using 9.0.3 (it could be something we fixed in 9.0.3):

 
 rule image_replace { 
    when HTTP_RESPONSE { 
       set clen [HTTP::header Content-Length] 
       if { $clen > 0 } { 
          HTTP::collect $clen 
       } 
    } 
    when HTTP_RESPONSE_DATA { 
       set last [string last "images/" [HTTP::payload $clen]] 
       for {set found 0} {$found < $last} {incr found 22} 
       { 
          set found [string first "images/" [HTTP::payload $clen] $found] 
          HTTP::payload replace $found 0 "http/195.6.184" 
       } 
    } 
 } 
 

In the "incr found 22" statement above, the number 22 comes from the length of the inserted text ("http/195.6.184" - 15 bytes), plus the length of the search string ("/images" - 7 bytes). You will want to adjust this to your specific strings. It's important to skip the inserted length because you could introduce an infinite loop if not.

Also, instead of doing this with a rule, you may want to consider using the stream profile. This profile allows the generic replacement of a string throughout the payload. You would configure it like so:

 
 profile stream image_replace { 
    source "images/" 
    target "http/195.6.184/images/" 
 } 
 virtual my_vip { 
    destination a.b.c.d:80 
    ip protocol tcp 
    profile http tcp 
    profile image_replace serverside 
    snat automap 
    ... 
 } 
 

The stream profile is much more efficient at replacing strings throughout the content.

I used your example strings verbatim, so I assume you will update them to whatever you need.

Let us know how it turns out.