Filtering it down by the hash prefix locally is much leas likly to be detected then spamming the servers.