. . . "Querying a database for suspect source IP addresses and file types and/or sizes implicated in past unauthorized transactions is generally less processing-intensive than generating and comparing content-based fingerprints." .