Which is useless if the domain had HSTS enabled, which they should.
HSTS for a domain is trust-on-first-use unless the domain is in the browser's preload list.