Link Literacy & Security for Female Journalists
Learn to read a web address like a detective: where it really goes, who owns it, and whether it is safe to open. One careless click can expose your sources, notes, and location.
Why link security matters
A link is the easiest door into your phone or laptop.
You are a target
Female journalists face heavier targeted phishing, spyware, and online harassment.
Most attacks start with a click
Phishing links are one of the most common ways accounts are stolen and devices infected.
Sources are at stake
A compromised device can reveal whistleblower messages, notes, and your location.
Knowledge is defence
Once you can take a URL apart, a deceptive link becomes a checkable address.
How the internet handles your click
Four steps happen in a moment. Attackers cheat at step 2.
- You ask. You tap a link or type a domain into the browser.
- DNS phonebook lookup. A DNS server turns the words into a numeric IP address, such as 192.0.2.1.
- Server handshake. Your device connects to the server at that address.
- Content delivered. The server sends the page back to your screen. If the address was fake, so is the page.
Anatomy of a link
Take this real-world example apart piece by piece.
https://shop.mtn.co.ughttps:// Protocol
The rules for moving data. The "s" means encrypted. Plain http:// can be read on public Wi-Fi. Analogy: a sealed envelope.
shop. Subdomain
A section the owner creates. Anyone who owns mtn.co.ug can make any subdomain (shop, pay, portal). Analogy: the pharmacy aisle in a supermarket.
mtn Root domain
The registered name, and the real owner of the site. Analogy: the name on the shop sign.
.co.ug Extension
Category (.co) and country (.ug). Others: .com, .org, .go.ug. Analogy: the town at the end of a postal address.
/ is only a page or tracking data (for example /article?id=92).Five deceptive links
Never open these. They are shown so you can recognise the pattern.
| Tactic | Example | What is really happening |
|---|---|---|
| 1. Lookalike characters | http://www.bbċ.com/newshttps://www.paypaI.com | A foreign or accented letter replaces a normal one (attackers often use lookalike Cyrillic letters), or a capital "I" replaces a lowercase "l". Risk: a clone site steals your login. |
| 2. Subdomain stacking | https://login.twitter.com.account-verify.xyz/login | "login.twitter.com" is only a subdomain. The real owner is account-verify.xyz. Risk: the brand name up front earns false trust. |
| 3. Shortened link | https://bit.ly/3x89QzA | Hides the real destination. Risk: can conceal malware downloads or fake login pages. |
| 4. Raw IP address | http://192.168.1.105/journalism/login | Numbers instead of a registered name, and no encryption. Risk: credentials can be intercepted, and there is no owner name to check. |
| 5. Open redirect | https://google.com/url?q=http://malicious-spyware.org | Starts on a trusted domain, then ?q= sends you to another site. Rule: inspect anything after ?, redirect=, or url= for a second address. |
Link verification checklist
Run it before every click, especially on messages you did not expect.
- Preview first. On a computer, hover to see the real address. On a phone, press and hold the link. Hidden text can point anywhere.
- Read right to left. Find the extension and check the word just before it.
- Expand short links (bit.ly, tinyurl) with a link-expander tool before opening.
- Confirm through another channel. If a "colleague" or "source" sends a link, call or message them on a separate app to check they sent it.
- Use a password manager. It will not auto-fill on a fake domain, which is an instant warning.
- Turn on two-step login (an authenticator app or security key, not SMS if you can avoid it) so a stolen password alone is not enough.
- Do not open the link on your main device if you are unsure. Ask your helpdesk instead.
Practice: safe or suspicious?
Decide first, then reveal the answer.
If you already clicked
- Disconnect the device from Wi-Fi and mobile data.
- Do not enter passwords or details. If you did, change that password at once from a different, clean device and turn on two-step login.
- Report it to the helpdesk and your editor, and warn anyone who may have received the same link.
- Protect sources. Assume messages on that device may be exposed and contact sensitive sources through a safe channel.
Stay vigilant. Protect your sources. Verify before you click.
Not sure about a link? Send it to the helpdesk before you open it.