shadowserver parser: drone feed has spam events

[ghost]

The drone report contains events that are actually spam and not malware.

"timestamp","ip","port","asn","geo","region","city","hostname","type","infection","url","agent","cc_ip","cc_port","cc_asn","cc_geo","cc_dns","count","proxy","application","p0f_genre","p0f_detail","machine_name","id","naics","sic","cc_naics","cc_sic","sector","cc_sector","ssl_cipher","family","tag","public_source"
"2018-07-10 18:50:25","127.0.0.1","","64496","AT","VIENNA","VIENNA","example.com","tcp","spam","https://example.com/link","","","","","","","","","","","","","","0","0","","","","","","","spam",""

These are wrongly classified as infected system/malware.

possible upgrade statement:

UPDATE events
   SET "classification.taxonomy" = 'abusive content', "classification.type" = 'spam', "classification.identifier" = 'spam'
   WHERE "malware.name" = 'spam' AND "feed.name" = 'Drone';

cc @th-certbund

[th-certbund]

Looks like those events in the drone report are messed up.
"hostname" usually is the reverse-lookup for the source ip but with those events it is the hostname included in "url". :-/
I've added events tagged as "spam" in the drone reports to our blacklist to completely drop them.

[ghost]

Asked shadowserver about the URL's meaning

possible fix in e25de3d