A computer-implemented method for automatically responding to domain name abuse is described. The method comprises the following steps. A plurality of disparate abuse feeds are received from a plurality of service providers. Each of the service providers is configured to collect information regarding a subset of potential domain name abuse and each abuse feed comprises data identifying domain names associated with the subset of potential domain name abuse. The data is filtered to create a custom abuse feed comprising a selective portion of the plurality of disparate abuse feeds. The filtered data from the custom abuse feed is grouped into groups of data based on predefined priority levels of the filtered data. For each of the groups of data, one or more corresponding workflows is executed as a response to the potential domain name abuse, wherein the workflow includes temporarily suspending a domain associated with the potential domain name abuse.