.xyz domains are commonly associated with malware, scams, and phishing, leading to such measures as multiple antimalware vendors blacklisting many or all .xyz domains.
I think it's pretty unfortunate .xyz domains ended up having such a bad reputation. I know when the tld first came out it was extremely cheap ($1 for the first year?) so I suspect anyone who wanted a good deal grabbed one.