Just encountered the same thing with a .XYZ parked on Afternic nameservers.
Clean on all sites, just two "Suspicious" flags by "AI Analysis" vendors on VirusTotal. Not even "Malicious" flags as in the OP's case, just "Suspicious".
I received no notification from @Dynadot or the registry about...