1. A computer-implemented method for detecting similar network activity, the method being carried out by a computer system having at least one processor, the method comprising: receiving records comprising groups of Internet Protocol (IP) addresses and a plurality of domains, a first group of the groups of IP addresses being associated with a first domain of the plurality of domains; applying, by the at least one processor, a first hash function to compute a first plurality of hash values for the first group, the first plurality of hash values including hash values for IP addresses in the first group; selecting a first hash value of the first plurality of hash values to determine a hash signature; outputting the hash signature and the first domain as a first pair; grouping the first pair with a second pair, the second pair comprising a second hash signature having a same value as the first hash signature and a second domain; and outputting the first domain and the second domain as a set of domains for use as candidates in a similarity computation.