To detect potentially malicious behavior or fraud, online environments maintain counts of a variety of data items received via a webpage or an application. A bucket scheme to track and retrieve these counts is described. The bucket system maintains a rolling count over a period of time. The bucket system comprises three different tiers, each containing buckets corresponding to different periods of time. When a new data item is received, one bucket in each tier is updated. The bucket is updated by generating a bucket address and initiating or incrementing a counter counting the number of times the data item was received. To retrieve the count over a specified period of time, the counters in a plurality of the buckets are read and aggregated.