Out-of-scope assets typically include:

Third-party services and hosted content - Employee personal accounts - Physical locations - Non-production environments (unless explicitly included) - Specific subdomains or IP ranges