i thought it was checks against a local list of hashes? with frequent updates