My input:

The links are always different, yet it always contains 'scarletcherryblossom' (my hotmail address) in the URL.

Also, they frequently happen in the morning, not at night. This particular screenshot was from just about 9 AM.