I had to blacklist .top and .xyz registrations for a free service because they were being used exclusively for spam. xyz in particular I think is just so cheap (often $0.99 to $2) that it's tempting for spammers to register a bunch of throwaway domains.

Reminds me of .info a decade ago. Guaranteed spam, malware, or phishing.

My work blocks xyz and the only xyz I’ve ever wanted to visit was the google/alphabet thing.