Your filters might have rules about .xyz. Otherwise it's legit, the only connections it makes are to google tag manager and google fonts, loads ~220kb, and works without javascript enabled. Hard to be malicious without javascript!

But for any domain you're unsure about, you should likely try a sandbox to get a definitive answer for yourself.