Malvertising Eclkspsa

Hi,

I need a help to find what is making my site open a popup when click sometimes.
It didn’t happens all the times, but it always open the same domain:

http://eclkspsa.com/adServe/sa?cid=SWTMPOP&pid=&q=Protesto%20Audio%20Visual&ap=cmp%3DPOPUNDER

I’ve tryed to pass the site into scan services like this:
https://sitecheck.sucuri.net
And none of then found anything.

I also installed anti-virus plugins like this:
https://wordpress.org/plugins/wp-antivirus-site-protection/
Nothing too.

I’ve downloaded all my files and tryed to find the word ‘eclkspsa’ in my source files, it is not there.

Could anybody help me please?

Thanks!