It’s a spammer AFAIK, I considered the possibility of it being used to get IP’s and deanonimize users through the image but it seems this isn’t the case since the image points to a generic pictrs file from a Lemmy instance and most clients / frontends proxy image loading.