[Device Reviews and Information] thigger_tom:
I managed to catch the app responsible by having a packet capture running when an ad popped up.

Unfortunately the app responsible was System UI (/system/priv-app/SystemUI/SystemUI.apk) - the version on my wife's phone is 6.0-1476950851 (2016-10-20)

If it's that deeply embedded then there's really nothing I can do!

For reference - the ad was served from 203.205.151.211 over port 80 (Whois states Shenzhen Tencent Computer Systems Company Limited)

Immediately prior to the ad the following bit of JSON took place (180.76.153.60 - Beijing Baidu Netcom Science and Technology Co., Ltd.)

OUT:

{"adslots":[{"build_type":2,"capacity":1,"id":"************","size":{"height":853,"width":576},"type":5}],"client":{"type":1},"deBug":false,"device":{"brand":"DOOGEE","ids":[{"id":"*****************","type":1}],"model":"X5max_PRO","os_type":1,"os_version":{"bulld":0,"major":6,"micro":0,"minor":0},"screen_size":{"height":1280,"width":720},"type":2},"media":{"type":1},"network":{"type":1}}

BACK:

{"Success":true,"Ads":[{"Adslot_id":"s1d7626d","Material_type":1,"Html_snippet":"","Native_material":{"Id":"0","Type":1,"Interaction_type":1,"Title":"","Description1":"","Description2":"","Image_url":"http://pgdt.gtimg.cn/gdt/0/DAADcisAJYAH0AA-BYEG3wCUTdW6oT.jpg/0?ck=8d8625c9595ffe36df43ba03d7cafd5a","Logo_url":"","Click_url":"http://114.55.188.148:81/click?viewid%3DgDvL7iBO6UD3KMTLXNbJzh6uPPKb5OzWOr3hb4u%21Dse1N5545qsy3_v8nkhdOtTJBXXe_yZAoLUOw40wo89vSf_bc4YhVFJQuEW5MjATfppJZRbb0weOEjFNvHT9%21Gj54opE0ZS1NROwYPxdvV0k1Nij63iU2scIEr7PrbWuYlvojuLZQd7bQnMC7cSkypQWrEAUXsp6sbQ%26jtype%3D0%26i%3D1%26os%3D2%26acttype%3D0+CAAQNQ.kRRlOYh2CKa2dv3VDKHpd0o2C8V2DKd0DQdKC0CXS8ivCKDpC870Dvd27YiDxO-ZXR4izPT5tRmPgR9N7YIqCYIpdj4lR39ROiVvCQHWd0NL7YR_Si3k3X2P3VRRjR3OCRiRnRRDRkiRSRARR4iRQ230S8aKdQ4zSQDmDK4LCQ_278oK7Q7u78hEDvRXDv_uC_NnkRnH7jNuk2d9hgoXS256DzGM7gHZIbnZDLsxJLhEh_sxDLqtDLFZ7KdMwWNSkRClk0nqCY4XC8N1dYAPkKdFUQdrIW3FUboPOQGuhpsm7QG07QGmUQHPC8nXd8H1dYiGCMXzCYnXSYnpC04vCYipC0nvBihZ7bhzDQGriiniHmDpHv_YdnCmH0nWS47ndY41C4NGCvCvd0iLdYDvdmOOR4INRoNNkRDHR3iRNRRU_Hi3ni5vd8NLS8nXSYRmdY4vCvnDR8iRl23VC8u0C8DpdQDm7jCzSYH1dYiX7QnGdQnW7YVuC8AES7N3YRi3niiNR3RRjRRiRON3kLtuILh6-zp2U0Rv9RDR","Impression_log_url":["http://v.gdt.qq.com/gdt_stats.fcg?count=1\u0026viewid0=gDvL7iBO6UD3KMTLXNbJzh6uPPKb5OzWOr3hb4u%21Dse1N5545qsy3_v8nkhdOtTJBXXe_yZAoLUOw40wo89vSf_bc4YhVFJQuEW5MjATfppJZRbb0weOEjFNvHT9%21Gj54opE0ZS1NROwYPxdvV0k1Nij63iU2scIEr7PrbWuYlvojuLZQd7bQnMC7cSkypQWrEAUXsp6sbQ","http://rcv.jesgoo.com/show?CAAQLg.oKvHeJcsrAZs91bnIAzU968srOnsIA96I59Ar6ryEON1rAIUrO06I19s0JNIkeWqyK-NFm4XYKxmdKtB0J7CrJ7U9S-HKbtKeNn1r5za96BV0JKRENbobysmbnKKSKbeJNNKvKKIKoNKEKLKK-NK-NzBK8b37NMBKCBerOvy9OKCr6NxrhteIVCYIVk17SCYcdtYWAZaGa8gWA9gWh8Y0JtCrOKU9JNxEJ3FuJByrOKMrO-F9OryEJ-FrO9mbV2gcaLnWAqeKzMBK8BBoKIzKbNKBKKMKeKSKK"],"AppName":"","Package":"","AppDownload":null,"AppInstall":null,"AppActive":null,"Image_size":{"Width":0,"Height":0},"Timestamp":1478202164227},"MaxAge":0}],"Search_id":"7b2eb70abd564b18bbccacf2309832f516cc3bd8","Jesgoo_id":"CF5C1C4C4B179FD4581B93336864637B"}

I've attached the jpeg that it downloaded (I'm sure xda's spam filters will get me on this one!)

Is nobody else getting anything like this? If it's SystemUI.apk then as far as I can see it's game over as there's no safe way to remove it!