A threat category for domains commonly used for Living Off the Land techniques, such as VSCode tunnels or generating OAuth tokens (for instance insiders.vscode.dev and global.rel.tunnels.api.visualstudio.com). The end user would have greater protection with minimal impact as the average user is unlikely to use them.