Your filters might have rules about .xyz. Otherwise it's legit, the only connections it makes are to google tag manager and google fonts, loads ~220kb, and work

Your filters might have rules about .xyz. Otherwise it's legit, the only connections it makes are to google tag manager and google fonts, loads ~220kb, and works without javascript enabled. Hard to be malicious without javascript! But for any domain you're unsure about, you should likely try a sandbox to get a definitive answer for yourself.