Daily Lookalike Domain Sweep into Linear

Every morning this workflow hunts the open web for domains that imitate your brand — common typos, character swaps, and added keywords like "login" or "support" — then turns the suspicious ones into actionable Linear tickets so your secops team can start takedown prep.

Use it when you want continuous, hands-off monitoring for brand-impersonation domains without a paid threat-intel feed. Ideal for security teams that already triage work in Linear and want a steady, deduplicated queue rather than noisy alerts.

1. 1A daily schedule fires the run at a fixed hour.
2. 2A Brave Search action queries a generated list of lookalike permutations of your brand name and domain.
3. 3A logic step scores each result on signals like edit distance to your real domain, presence of phishing keywords, and recency, then filters out low-risk and already-known hits.
4. 4For each surviving candidate, a Linear action creates a ticket pre-filled with the domain, risk score, and evidence snippet.
5. 5The output posts a one-line run summary so the team knows the sweep completed and how many tickets were opened.