Interesting - I also used Jaccard similarity to classify clusters of malicious ad traffic schemes. The idea worked well. It was unclear if the similarity was due to mimicry or authorship, but that did not matter for our use.