I uses to use Jaccard similarity combined with w-shingling at the character level to detect clusters of fraud sites. It was surprisingly effective, because it was able to pick up common patterns in the code even if they used completely different styles and text.