Apparently a scammer has registered the default base url genreated by hugo ("http://replace-this-with-your-hugo-site.com") and has some malware, ads, etc on it. See: spf13/hugoThemes#171.
To avoid such abuse in the future I would recommend to switch to a base url like "https://www.example.com".
Switch to use safe baseURL in config/readme (#33)
Fixed in commit: 62f68c0