diff --git a/README.md b/README.md
index 72f7dfe..1b72f49 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,5 @@
 <p align="center">
   <img src="https://img.shields.io/badge/Flock_Scan-v3.1-red?style=flat-square&logo=appveyor" />
-  <img src="https://img.shields.io/badge/CVEs-4-brightgreen-brightgreen?style=flat-square" />
   <img src="https://img.shields.io/badge/license-MIT-blue?style=flat-square" />
 </p>
 
@@ -13,7 +12,7 @@
 ╚═╝     ╚══════╝ ╚═════╝  ╚═════╝╚═╝  ╚═╝     ╚══════╝ ╚═════╝╚═╝  ╚═╝╚═╝  ╚═══╝
 ```
 
-Multi-mode Flock Safety security assessment tool.
+Multi-mode Flock Safety security assessment tool. Flock_scan is intended to see what else we are not seeing. Our hardwear hacker homies are killing it on scanning the phsyical layer so i built flock_scan to help scan the network and application layers.
 
 ---
 
@@ -157,7 +156,24 @@ TLS Traffic Categories:
 pip install requests
 sudo python3 scanner.py
 ```
+### Enrichment Mode (v3.0+)
+```bash
+# Add --enrich to any scan for extra data collection
+sudo python3 scanner.py -t 192.168.1.100 --enrich
+sudo python3 scanner.py -f targets.txt --enrich --output enriched_scan.json
+sudo python3 scanner.py --discover 192.168.1.0/24 --enrich -v
+```
 
+**What --enrich adds:**
+- **Banner grabber** -- HTTP headers (Server, X-Powered-By, Via, cookies), FTP banner (SpeedPourer version), TLS cert (SANs, issuer, expiry), SSH version
+- **Cloud provider enrichment** -- IP → ASN/org/provider via ip-api.com + WHOIS fallback (AWS, GCP, Azure, Cloudflare, etc.)
+- **Telemetry detection** -- Google Analytics IDs, Hotjar, Sentry, Facebook Pixel, Segment, and 30+ other SaaS services
+- **ADB deep collect** -- WiFi SSID/BSSID, gateway, DNS servers, ARP table, uptime, processes, battery state, installed packages, logcat errors
+- **Network map** -- Passive subnet discovery via ARP table + MAC OUI vendor resolution
+- **Credential extractor** -- Scans HTTP bodies for leaked M2M OAuth client_id/secret, webhook API keys, Auth0 configs, org UUIDs
+- **Prometheus scraper** -- Probes local network for open Prometheus/Grafana instances, scrapes targets + metrics
+- **S3 URL catcher** -- Extracts signed S3 image URLs from captured traffic (flock-hibiki-inbox, hotlist, webhook payloads)
+  
 ### CVE Scanning
 ```bash
 sudo python3 scanner.py -t 192.168.1.100
@@ -193,23 +209,7 @@ sudo python3 scanner.py --tap-pcap capture.pcap --tap-output report.json
 sudo tcpdump -i eth0 -l -nn | sudo python3 scanner.py --tap-pipe -v
 ```
 
-### Enrichment Mode (v3.0+)
-```bash
-# Add --enrich to any scan for extra data collection
-sudo python3 scanner.py -t 192.168.1.100 --enrich
-sudo python3 scanner.py -f targets.txt --enrich --output enriched_scan.json
-sudo python3 scanner.py --discover 192.168.1.0/24 --enrich -v
-```
 
-**What --enrich adds:**
-- **Banner grabber** -- HTTP headers (Server, X-Powered-By, Via, cookies), FTP banner (SpeedPourer version), TLS cert (SANs, issuer, expiry), SSH version
-- **Cloud provider enrichment** -- IP → ASN/org/provider via ip-api.com + WHOIS fallback (AWS, GCP, Azure, Cloudflare, etc.)
-- **Telemetry detection** -- Google Analytics IDs, Hotjar, Sentry, Facebook Pixel, Segment, and 30+ other SaaS services
-- **ADB deep collect** -- WiFi SSID/BSSID, gateway, DNS servers, ARP table, uptime, processes, battery state, installed packages, logcat errors
-- **Network map** -- Passive subnet discovery via ARP table + MAC OUI vendor resolution
-- **Credential extractor** -- Scans HTTP bodies for leaked M2M OAuth client_id/secret, webhook API keys, Auth0 configs, org UUIDs
-- **Prometheus scraper** -- Probes local network for open Prometheus/Grafana instances, scrapes targets + metrics
-- **S3 URL catcher** -- Extracts signed S3 image URLs from captured traffic (flock-hibiki-inbox, hotlist, webhook payloads)
 
 ---
 
@@ -336,30 +336,8 @@ sudo python3 scanner.py -t 192.168.1.100 --exploit
 
 ---
 
-##  File Layout
-
-```
-FLOCK_scan/
-├── scanner.py                # Main tool (CVE scan + discovery + traffic analysis)
-├── flock_tap.py              # Passive traffic monitor (callbacks, FRP, SNI, DNS)
-├── shodan_queries.py         # Shodan dork generator
-├── run_scanner.sh            # Quick-launch script
-├── masscan_wrapper.sh        # Masscan integration
-├── modules/                  # Enrichment modules (v3.1+)
-│   ├── __init__.py
-│   ├── banner_grabber.py     # HTTP/FTP/TLS/SSH banner collection
-│   ├── cloud_enrich.py       # IP → ASN/org/cloud provider
-│   ├── telemetry.py          # Analytics, pixels, JS endpoints
-│   ├── adb_deep.py           # Extended ADB props (route, wifi, DNS, processes)
-│   ├── network_map.py        # ARP-based passive subnet discovery
-│   ├── creds_extractor.py    # Leaked M2M tokens, webhook API keys, auth configs
-│   ├── prometheus_scraper.py # Prometheus/Grafana discovery on local network
-│   └── s3_url_catcher.py     # Signed S3 image URL extraction from traffic
-└── README.md
-```
-
 ---
 
 <p align="center">
   <sub>Authorized security testing only. Use on systems you own or have written permission to test.</sub>
-</p>
+</p>
\ No newline at end of file