hyperkykai[.]live

The domain hyperkykai.live was registered on May 15, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolving to the Cloudflare address 172.67.209.213 located in Canada. The site returns HTTP 200 and presents a page titled “Hyperkykai | Official Platform for AI Assisted Trading”. The infrastructure is still active as of the report date.

Technical inspection shows the domain uses the Cloudflare nameservers rob.ns.cloudflare.com and selah.ns.cloudflare.com and presents a valid Let’s Encrypt certificate (CN = E8). The Gridinsoft trust score is 0 / 100, and the domain appears on one security blocklist, where it is also listed by PhishDestroy. VirusTotal records two positive detections out of ninety‑five scanners, and AlienVault OTX references a single threat pulse that cites the same indicator.

Threat intelligence classifies hyperkykai.live as an investment‑scam phishing site. The landing page mimics a legitimate AI‑assisted trading platform, aiming to lure victims into providing credentials or financial details. The presence of the domain on a blocklist and the two VirusTotal flags support the malicious intent, while the page’s content aligns with typical generic‑phishing tactics.

Open questions remain regarding the full payload delivery mechanism and any associated command‑and‑control infrastructure. No malicious binaries or scripts have been publicly disclosed, and the limited number of antivirus detections suggests that the primary value proposition of the site is credential harvesting rather than malware distribution. Further collection of phishing emails or victim reports would clarify the scope.

Defenders should add hyperkykai.live to URL filtering and email‑gateway block lists, monitor DNS queries for the associated Cloudflare IP range, and consider sinkholing the domain to disrupt traffic. Continuous threat‑feed updates are advised, as the domain may be reused in future campaigns or linked to additional malicious indicators.