I don't believe that it is Malware. I think it is something that RF uses on links as a middle man to get a little income for the site. Kinda like those penny clicks that you get on google but...