Abstract: In one embodiment, a fingerprint is generated for each document (e.g., e-mail, web page) containing markup language (e.g., HTML) code. The fingerprint is indicative of the structure of the markup language code in the document. The fingerprint may be formed by extracting markup language tags from the document and then linking together the extracted tags to form a single string. The fingerprint may be hashed through a hashing function to generate a signature key that may be used to create a directory for the document and other documents having the same fingerprint. The grouping of documents with the same fingerprint facilitates creation of anti-spam rules or identification of web pages from particular websites, for example.