Browser Jijack?

Issue, Samsung s2 android 4.1.2 on Tmo
My wifes phone keeps popping up a dialog to choose a browser( thats not the issue, she hadnt set a default), but the problem is its popping up randomly, pretty often trying to open this page( which i allowed it to:


I copied the address it trying to reach
Code:

h t t p:/ /w w w.androidsecurityfree.org/v3e/index.html?version=locked-suite&wwd=2&page=aa.matt.5svp.0830&split=1390677a& ccrule=33cbf077&offer=aa.matt.3tfi&product=anti-virus&partner=nb&country=us&language=en&pool=e7cd2 767&pop=0&affid=184772&subid=&subid2=OjU6NDg6MTY6A mZzJHUgYKBh7H9Rbw-2mDHW81APED2pdCwdvg7Qv0C5GiYo97THjC_rDk8yLfcrE48du rZ5pRNnwtMSrz8ARw&shortcut=aausnb&ipcc=us&iprc=ca& xsid=l1S4xXuJnUuv3ETpaJZz4g&ccconfigid=348fbd4

The issue is continues regardless of reboot, close out the browser, clear cache/data. it keep coming back
She has the free version of lookout installed and it doesn't find anything.
any clues as to what is happening?
Sees like a hijack of some sort..

 

thanks, ran the lookout ad network detector and found a common theme...Draw Free.
Uninstalled it.
Ran addons detector and it came back as clean.
We shall see how it progresses.

 

ok...something is up for sure. I wiped my phone and reflashed a stock ROM from XDAforums that was debloated and deodexed etc.
Its been working fine for days suddenly today the same popup appeared, this time its green.
WHAT is going on, i havent installed anything...
EXCEPT swiftkey 3..
uninstalled and watching.
so far no popups