.co WHOIS Lookup

The registry chose to write down what to do rather than leave the fields empty. In the record we measured, the registrant, admin, tech and billing email fields all carried the same text: for contact details, query the service of the registrar of record named in the output. A field looking filled does not mean the data is open — there is a direction where an address should be. The registrar's abuse email and phone, by contrast, appear with real values in the same reply.

Not at registry level. The reply holds no field for the registrant's name, address or phone, and the email fields carry a referral rather than an address. What it does state plainly is which registrar sold the name, and that registrar's own registration data service is the second step. With a legitimate reason that is the route to take; for reporting abuse, the email and phone you need are already in the reply.

The billing role records where correspondence about the domain's charges should go, and it is a leftover from older WHOIS templates. Many registries removed the role from their output entirely; .co still keeps the field in the reply. In the record we measured its value matched the other three contact fields, so it carried no real address. Seeing the field tells you the role is defined in the registration database.

It does. The reply gives the creation date in Creation Date, the last modification in Updated Date and the end of the term in Registry Expiry Date, all in UTC. The record we measured was opened in 2010 and its expiry date fell in 2027. Our result screen derives the domain's age and remaining term from those three values, and turns the indicator to a warning colour as the term runs short.

IANA's RDAP bootstrap registry defines no endpoint for .co, which our measurement on 12 August 2026 confirmed. That means any tool discovering endpoints through bootstrap comes up empty for this extension. The registry's own notice does mention WHOIS and RDAP services together, but until the entry reaches bootstrap, automatic discovery cannot work. In practice the address for .co data is the port 43 WHOIS service.

The record we measured carried three codes, all prefixed client: deletion, transfer and update were locked by the registrar managing the name. That prefix is good news in practice, because the party that set the lock is the party that can lift it; codes prefixed server can only be lifted by the registry. On our result screen each code is printed with an explanation of what it blocks.

The notice at the end of the reply states that the service is offered for limited use and that high-volume automated access is not accepted. A single lookup is never affected; the problem appears with tools firing many requests at the same server in sequence. On our side, concurrent requests for one name collapse into a single query and a registered result is kept for six hours, which keeps unnecessary load off the registry.

Query a name nobody holds and the registry reports that no match was found; none of the nineteen fields arrive. That means the name looks free to register. We keep such a result for five minutes only, because a name that looks free can be taken quickly, against six hours for registered names.