I can't answer to the law, which besides will vary - and I reject the implication that a puerile prank is immoral. But that aside, taking it on as if there was any moral dimension, moral clarity is straightforward here:
The parasite has to answer for the material it shows its visitors.
If a butcher delivers outdated meat to nowhere, knowing his van will be hijacked, how can he possibly be blamed when the hijackers sell it to their customers?
> If a butcher delivers outdated meat to nowhere, knowing his van will be hijacked, how can he possibly be blamed when the hijackers sell it to their customers?
An obvious corrolary to this is the prohibition on booby traps.
I am not sure that actually, the intermediate site is even technically sending the image.
As I understand it, the iframe is set up such that the users browser loads your site inside the frame and the intermediate site outside of the frame. If you serve a file then you are serving it directly to the browser. The intermediate site never sees it?
They could've also embraced it, see it as marketing, and replace it with a direct link to their website instead. Youtube doesn't care about people embedding their videos, they can make money regardless.
Imagine you were distributing my work without permission and in retaliation I emailed you gross-out sexually explicit imagery. That would both be a crime and be unethical by current standards.
OP is not emailing people, but it is the same thing: revenge using explicit imagery. Except not only might the people behind the sites see the image but their visitors which probably include minors will too.