HPKP isn't a centrally managed list, it's remembered by clients who've received HPKP headers when visiting your site (or in this case, the attacker controlled s

HPKP isn't a centrally managed list, it's remembered by clients who've received HPKP headers when visiting your site (or in this case, the attacker controlled site at your domain).