This probably came from a infected website … a redirector

microsoft call it Trojan:HTML/Redirector.CF

click Technical info tab here for info
https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Trojan%3AHTML%2FRedirector.CF#tab=2