Ideally, you'd sue the website because the website is responsible for everything that shows up on the website they control, and the website would turn around and sue their ad provider because they paid that ad provider for a service that wasn't malware delivery and as a result of that ad provider's crimes (or negligence) the website now has legal costs and harm to their reputation.

It shouldn't fall on the person just going to a website to track down the vendors and third parties the website contracts with.