Basically any 2-letter TLD should be avoided unless you live in that country.

If you want to be clever, use subdomains and pick one of the new TLDs. For instance, ban.anal.ink, is like $5.

If you’re hosting an instance on a risky TLD and you wanna migrate, probably best to close signups now and disallow any new communities from being created on there

familyphotos.zip

Some TLDs that aren’t country codes but also aren’t very useful or popular will sometimes be blanket blocked by institutions, on the theory that there’s so many more garbage malware C&Cs or whatever than actual useful sites that it makes sense to ban the whole thing. So you might not want to go with .bingo or .rest or anything with no perceivable use.

.biz always seemed a bit sketchy. Would probably also avoid .nk