Needing Help Determining Suspicious User Activity using freq_rare detector

[richcollier]

So, why not use:

rare by domain over identities

Finds identities that accesses rare domains