Host or AS (autonomous server) issue comes down to a certain level of semantics and initially crude differentiation – so we will commence with an ‘a b c’ method:

(a) Hosts / Servers / AS of 'infected sites' = - i.e. infected or hacked sites / domains which have bad exploit code, infected iFrame, SQL injections,  XSS exploits, etc.  to exploit visitors.

(b) Hosts / Servers / AS of 'user infector sites' =  i.e. where the malware and rogues are located and more often than not, users are directed to from infections on sites within (a)

(c) Hosts / Servers / AS of 'user receptor sites'  = The ultimately very bad  =   including the so called "the bullet proof servers" masked by the botnets to; receive, trade, pay affiliates, warez, etc. etc. - from (b); stolen IDs, credit cards, bank phishing info, for (a)  to pay partners and affiliates to infect the web sites. Also for DDos Botnet C&C (command and control) actions.