i thought it was checks against a local list of hashes? with frequent updates
this is how Firefox does it. can't speak for the rest.
this is how Firefox does it. can't speak for the rest.