If it was at the direct, they would have rolled with the “teasers” that people invented

Here is the URL of the one I was sent: https://lemmy.doesnotexist.club/pictrs/image/44f99f51-2ae9-49b0-b0c8-4ae4cb989690.png

It’s potentially unique and not from a service by my instance or imgur, so the attack is feasible.