Are there ways to serve a related cert 'by accident' if you don't set up https explicitly for a domain?

Annualmedicalreport is in a related line of work to this site - it's not about medical care but about looking up the information health insurers gather about patients. It has some positive reviews from real news sources, but it also sets off some alarm bells for me. It seems to be eager for your data itself, and has a weird sideline of articles about non-medical consumer reporting that read like sponsored content.

Given all that, I wouldn't be surprised if they were connected to (possibly the creator of) this broker site, and that's why their cert is being served.

None of which actually makes me feel better, and the failure to disclose Analytics certainly isn't encouraging.