1. A method, comprising: identifying a feature dimension on a social networking system to detect anomalies, the feature dimension being a non-content feature dimension; extracting URL chunks from content associated with a user action, wherein the user action records an interaction between a user account and a content object and wherein the user action is captured by an action logger of the social networking system; maintaining a plurality of feature distributions respectively corresponding to a plurality of unique URL chunks identified in content of a plurality of user actions occurring on the social networking system, wherein each of the feature distributions represents an aggregation of non-content features along the identified feature dimension across the plurality of user actions for a unique URL chunk of the plurality of unique URL chunks; aggregating a non-content feature of the user action along the identified feature dimension into a subset of the plurality of feature distributions respectively corresponding to the extracted URL chunks; determining whether a feature distribution of a particular URL chunk from the plurality of feature distributions of the URL chunks exceeds an expectation threshold for the feature dimension, wherein the expectation threshold corresponds to a characterization of an expected distribution along the identified feature dimension; and classifying the particular URL chunk as an illegitimate URL when the feature distribution exceeds the expectation threshold to restrict access to the particular URL chunk on a social networking system.