diff --git a/docs/source/malware_report.rst b/docs/source/malware_report.rst
index f72fdd42..e695ec17 100644
--- a/docs/source/malware_report.rst
+++ b/docs/source/malware_report.rst
@@ -11,7 +11,7 @@ With these rules, Quark is now able to identify the DroidKungFu malware family a
 
 Below is a summary report of a DroidKungFu sample (``D277C97B1A8A78F859672B4A20E74B3313E9F964E68A6E857C1E9D33763434A5``). The report shows that Quark identified the sample as **high-risk** and provided a list of the sample's behaviors.
 
-.. image:: https://cdn.imgpile.com/f/dna1NWm_xl.png
+.. image:: https://i.ibb.co/99dXBM7f/quark-dna1-NWm-xl.png
 
 Identified Well-Known Threats
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -20,7 +20,7 @@ With Quark's rule classification feature, analysts can generate behavior maps an
 
 **1. Gain unlimited access to a device**
 
-.. image:: https://cdn.imgpile.com/f/4nCi9mL_xl.png
+.. image:: https://i.ibb.co/ZpGgwNjL/quark-4n-Ci9m-L-xl.png
 
 The diagram shows that the ``Lcom/google/update/UpdateService;getPermission2`` function runs shell scripts and Linux commands directly, and also calls the ``Lcom/google/update/Utils;oldrun`` function to execute additional commands.
 
@@ -31,7 +31,7 @@ Behaviors detected by Quark:
 
 **2. Install/Uninstall additional apps**
 
-.. image:: https://cdn.imgpile.com/f/jpAr3Tm_xl.png
+.. image:: https://i.ibb.co/23Qfyq76/quark-jp-Ar3-Tm-xl.png
 
 The diagram shows that the ``Lcom/waps/k;a`` function installs APKs from a file, and calls the ``Lcom/waps/l;a`` function to install more APKs and the ``Lcom/waps/k;b`` function to connect to a URL.
 
@@ -42,7 +42,7 @@ Behaviors detected by Quark:
 
 **3. Forward confidential data**
 
-.. image:: https://cdn.imgpile.com/f/TsURgyN_xl.png
+.. image:: https://i.ibb.co/zT3vVjBB/quark-Ts-URgy-N-xl.png
 
 The diagram shows that the ``Lcom/madhouse/android/ads/_;_`` function queries confidential data such as SMS and call logs and also calls the ``Lcom/madhouse/android/ads/_;__`` function to check for network connectivity.
 
@@ -651,7 +651,7 @@ With these rules, Quark is now able to identify the GoldDream malware family as
 
 Below is a summary report of a GoldDream sample (``ECA3A3666B0FD72028431431E7FAE6774A8CA692E35AE3CB44FD8F2AA418F746``). The report shows that Quark identified the sample as **high-risk**, with a list of behaviors as evidence.
 
-.. image:: https://cdn.imgpile.com/f/qg9XDXG_xl.png
+.. image:: https://i.ibb.co/zVzQntPH/quark-qg9-XDXG-xl.png
 
 Identified Well-Known Threats
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -660,7 +660,7 @@ With Quark's rule classification feature, analysts can generate behavior maps an
 
 **1. Monitor SMS messages and phone calls**
 
-.. image:: https://cdn.imgpile.com/f/egCf5BD_xl.png
+.. image:: https://i.ibb.co/QFcHWfYR/quark-eg-Cf5-BD-xl.png
 
 The behavior map shows that the ``Lcom/sjhi/client/zjReceiver;onReceive`` function monitors SMS messages and phone call activity. It also calls the ``Lcom/sjhi/client/zjReceiver;a`` function to collect the data into files.
 
@@ -673,7 +673,7 @@ Behaviors detected by Quark:
 
 **2. Upload SMS messages and phone calls to remote servers**
 
-.. image:: https://cdn.imgpile.com/f/SOrA9Qz_xl.png
+.. image:: https://i.ibb.co/rGGtzyWJ/quark-SOr-A9-Qz-xl.png
 
 The behavior map shows that the ``Lcom/sjhi/client/e;a`` function connects to a URL and writes a file to an output stream. If the output stream is from the URL, this indicates the function uploads a file to a remote server.