The assembly line behind 1.5 million malicious domains