From 87a5c1c27d8ff344e6b329b21c6e4daf51960fc0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=A3=8E=E8=B5=B7?=
 <37897216+wikiZ@users.noreply.github.com>
Date: Fri, 12 Aug 2022 09:20:21 +0800
Subject: [PATCH] Update README.md

---
 README.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/README.md b/README.md
index cc224ff..0b52c0f 100644
--- a/README.md
+++ b/README.md
@@ -185,6 +185,14 @@ Another interception method is DROP, which directly closes the HTTP communicatio
 
 It can be seen that the C2 front flow control directly close response to illegal requests without the HTTP response code. In the detection of cyberspace mapping, the DROP method can hide the opening of ports. The specific effect can be seen in the following case. analyze.
 
+## JA3 fingerprint recognition cloud sandbox analysis traffic
+
+RedGuard currently supports the function of identifying cloud sandboxes based on JA3 fingerprints, which can identify and intercept network requests initiated in the cloud sandbox environment to prevent subsequent connectivity analysis, which further affects the security of C2 facilities.
+
+Currently supports the identification and interception of the threatbook cloud sandbox as an effect demonstration
+
+![1653132755(1).png](https://github.com/wikiZ/RedGuardImage/raw/main/ebd60b93323db5096328e8f20a2f1df.jpg)
+
 ## Proxy port modification
 
 The configuration of the following two parameters in the configuration file realizes the effect of changing the reverse proxy port. It is recommended to use the default port hiding as long as it does not conflict with the current server port. If it must be modified, then pay attention to the `:` of the parameter value not to be missing