I'm aware of the image, and even if the page actually looked like that for 10 minutes while he was taking the screenshot I'd still think it's obvious that his

I'm aware of the image, and even if the page actually looked like that for 10 minutes while he was taking the screenshot I'd still think it's obvious that his intent was not to confuse people with this site. https://crt.sh/?id=393002115&opt=ocsp https://crt.sh/?id=393002115&opt=ocsp Just compare the revocation date and the archive.org date. At best they revoked the cert after it had been used to serve a completely different site for many months.