Okay, heard back from coder. His was a hunch, based on the fact that this was a new addition. All the other plugins were there for months. So it may if fact be something else but test for yourselves. I’ve deleted it to be safe.
I’ve asked coder to provide.
My coder is cleaning up the site now. The plugin redirects visitors through multiple URLs to ads. Not sure what proof I can give you without revealing my client’s site.