[deanhills]

I understand @deanhills, not everyone's opinion is the same but yes I would still go for another TLD than .com if it's not a company/project for whom a website is being built. If proper server security measures are taken, I do think it will be an issue to even not mask the IP with CloudFlare and use the latter for only DNS requirements.

Agreed. Perhaps our thinking is the same after all. I have a few domains like that, i.e. personal projects that I'm not worried about and don't particularly care about traffic. I have three domains from freenom that I've successfully had for a number of years renewing them for free. Could be my low profile on those has allowed for just the right amount of traffic for Freenom to allow me to have kept it so long, and not to have attracted negative spam/hacking attention. I also have a few very cheap domains from Namecheap in the same category as dot.xyz viz: dot.review, dot.rocks, dot.club. I'm not particularly worried about exposure, i.e. I'm not really interested in getting traffic.

I agree with @rudra. I once had a domain called noobnotes.net. I'm almost certain the name of the domain attracted negative attention that caused it to be shut down and I was locked out of the Website. So I agree. If one uses certain "niche" names, one needs to beef up security. And in this case possibly CloudFlare Name Servers would have been good to use. Or some added protection on top of standard security plugins like WordFence. Instead I let go of the domain. I tried to use it a second time on a different VPS, and surprise surprise the negative attention was exactly the same. Looks like once a domain has attracted negative attention, the Internet doesn't seem to forget about it.