Sure they are. The domain you want isn't.

GitHub.io domains, workers.dev domains, etc are all free domains.

Clever use and abuse of some startups can get you a free domain with a signup package that you can subsequently transfer out, but those are harder to find these days.

Seriously, the bad guys figure this out all the time.