.co.xx is common in Britain (.co.uk), Japan (.co.jp), New Zealand (.co.nz) and probably others. It's perfectly legitimate for a site linked to those countries.
NZ didn't allow registration of raw .nz domains until 2014 so anything registered before that was a .co.nz or similar. It's still more common than .nz due to inertia / muscle memory I guess. I get weird looks when I give people my (name).nz email address - usually people ask if I meant .co.nZ
BR went the other way. Registration of raw .br domains used to be allowed for universities, but AFAIK other than grandfathered registrations it's no longer allowed (new registrations have to use .edu.br).
My suspicion is that it was due to abuse; a long time ago, I noticed some university had registered IIRC .co.br (our correct equivalent to the .com gTLD is .com.br; this is a notable exception to the assertion above that "I rarely find a reputable business that is using anything but .com or .co.XX as the primary domain", since plenty of reputable businesses use .com.br as their primary domain, not .co.br which doesn't exist).
.co.xx is common in Britain (.co.uk), Japan (.co.jp), New Zealand (.co.nz) and probably others. It's perfectly legitimate for a site linked to those countries.