Same as any other pop-up you get when visiting a website if you don't block them.
Ads are a very likely source as websites usually don't host the ads that appear on their site. They effectively rent out their ad space to a third party who supplies the ads. Think Google ads.
There might be another layer or two before you get to the actual server supplying the ad and if that server has been hacked you can get a dodgy ad served up to you through a reputable website.
It's not any one person/organisation that's doing this and they're rather hard to track down - they aren't sitting in London or New York using their own Internet connection.