In domain-security systems, a skeleton is a simplified string representation of a hostname or label that removes or normalizes characters so visually similar names can be compared more reliably. For example, different Unicode letters may look alike in a browser but map to the same or closely related skeleton.
This matters because attackers use lookalike domains for typosquatting, phishing, and brand impersonation. A domain may be technically valid in DNS yet appear trustworthy to a user because of confusable characters or browser rendering choices. Security tools use skeleton checks to spot suspicious registrations, compare them against protected brands, and decide whether a label is safe to display as Unicode or should stay in Punycode. In practice, a mismatch between a domain’s visible form and its skeleton can be a strong warning sign of spoofing.