1. A method for detecting anomalous activity in an online service, comprising: accessing a baseline profile comprising past event information related to a plurality of past events, wherein each past event in the plurality of past events originates from at least one account of the online service; calculating a first past event frequency for a first past event, wherein the first past event frequency is determined in relation to the other past events in the plurality of past events; calculating a second past event frequency for a second past event, wherein the second past event frequency is determined in relation to the other past events in the plurality of past events; accessing a recent profile comprising recent event information related to recent events that originate from accounts of the online service; calculating a first recent event frequency for a first recent event in the recent events, wherein the first recent event frequency is determined in relation to the other recent events; calculating a second recent event frequency for a second recent, wherein the second recent event frequency is determined in relation to other recent events determining that the first past event occurs at a higher frequency than the first recent event; determining that the second past event occurs at a lower frequency than the second recent event; and generating a report, wherein the report includes information related to the first past event occurring at the higher frequency than the first recent event and the second past event occurring at the lower frequency than the second recent event.