Looks like someone set up a new IT workshop and is stealing sites to fill up their portfolio. The url says demo1, so they are trying to show your site as a demo

Looks like someone set up a new IT workshop and is stealing sites to fill up their portfolio. The url says demo1, so they are trying to show your site as a demo, as if it was designed by them.