Each row is a target that discovery proposed and the scope validator refused before any packet was sent. Nothing here was probed, so this is the guard working rather than failing. A non-zero count is expected now that a passive DNS source proposes names, because many Nepali sites are fronted by foreign CDNs whose addresses lie outside the delegation. Read the reasons below to separate that ordinary case from a genuine enforcement bug.