Using an xyz domain name is a way to give up your agency:

   In 2023, the Anti-Phishing Working Group stated that 
   the .xyz, and .shop domain names were in the top 5 for 
   malicious domain registrations[7] Due to these instances of 
   malware, scams, and phishing, multiple anti-malware vendors 
   are blacklisting many or all .xyz domains

https://en.wikipedia.org/wiki/.xyz

They are blocked where I work.