Example dirty diff:
https://en.wikipedia.org/wiki/Special:Diff/831758546#References

The image when decoded seems to be some sort of green badge, which i'm associating with a anti-virus like safe web browsing feature or something checking the urls in the edit surface. I know we have added patterns like this to a VE blacklist before for other browser extensions, i suggest we do that for this one too.