One of my client sites (a Wordpress site) seems to be redirecting visitors to a malware page which looks like a Google site and offers visitors a free phone:

Congratulations! You are one of the 100 users we have selected for a chance to win an iPhone X, Samsung Galaxy S9 or iPad Pro

I've looked through the site and can't find what's triggering this, does anyone have any idea where the malware is, or what its signature is?