I wonder if xyz.com is simply requesting TLDs based on domains their users enter, so cmo and con come from their users’ typos rather than malicious intent. It would be similar to how some registrars park domains when a user checks if a domain is available.

Yes, these should be banned.