I managed a hosted email platform in the past and can confirm one of our spam filters was a simple whitelist of all know TLD's, which was manually updated every now and then. We eventually dropped it when new TLD's where announced every few weeks. Can image some providers still use these kinds of lists and not updating them because they receive no complaints.

> not updating them because they receive no complaints.

I wonder why...

There are still enough sites that actually call emails with some TLDs invalid when signing up. So I can imagine some of them simply have a fixed list when sending/receiving emails and just reject all the rest.

Seeing so much spam from it, I'm not surprised. I'm thinking to start doing the same.

I am wondering why spammers decided to use it, I'm suspecting it's very trivial to get a domain there.

I blacklist .xyz, .ninja, and a few others. Nobody complains.

I had to blacklist .top and .xyz registrations for a free service because they were being used exclusively for spam. xyz in particular I think is just so cheap (often $0.99 to $2) that it's tempting for spammers to register a bunch of throwaway domains.

Reminds me of .info a decade ago. Guaranteed spam, malware, or phishing.

My work blocks xyz and the only xyz I’ve ever wanted to visit was the google/alphabet thing.