Ok, so they'd only know that you visited a domain like this at a given time?

securedrop.ap.org

That still gives away a lot, many of these secure drop sites are on a subdomain.