Sucks that I have to preface but people can be jumpy here. This is genuine curiosity, I’m actually asking, because it’s really probably something I should already know. Can you explain the nuance to me please?

My understanding, speaking mostly of apps/websites, I know jobs can be much different:

Most places have the first factor as a password.

First factor (or “login”) = username+password pair.

For the longest time that was all there was, “your login” was just a login, which meant a username and password combination. Then 2FA/MFA (“2 factor authentication / multi-factor authentication”) came along in the form of username+password combo plus SMS/email/Google Authenticator/Yubikey/etc to verify as the 2nd form of authentication. You can have 3FA 4FA 5FA whatever if you want and if it’s supported by the app/website. So 2FA is MFA, but MFA is not necessarily 2FA.

I know jobs can be set up a lot differently.

MFA - 1 = SFA

aka password login

Since its servhold, you may be able to remove the offending content (for a short time, anything public-facing) and then contact reg.xyz to get it unsuspended. You’re right though that’s not very good customer service.

On a related note, it’s possible a misconfiguration allowed some of the contents or index to be shown publicly and it got caught in a search engine and was taken down in an automated DMCA sweep. I believe .xyz is an American registrar so have to respond to DMCA but could be wrong on that. I like to stay with any .TLD that archive uses… md, ph, etc.

https://help.sav.com/hc/en-us/articles/11933048624923-Resolving-serverHold-on-Your-Domain

Njalla just buys domains from major registrars on your behalf and owns them on your behalf. Godaddy, Tucows, etc. It was the owner of the entire .xyz space (gen.xyz) who shut your domain down. Njalla is just passing along the info. Porkbun will do the same.