Have I Been Pwned? V2

Uses the Have I Been Pwned? service to check whether email addresses, domains, or usernames were compromised in previous breaches.

Data Enrichment & Threat Intelligence · Pwned

Details

IDHave I Been Pwned? V2
ProviderTroy Hunt
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Overview

Uses the Have I Been Pwned? service to check whether email addresses, domains, or usernames were compromised in previous breaches. Uses API v3.

Configure Have I Been Pwned? V2 on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Have I Been Pwned? V2.
  3. Click Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • API Key
    • Maximum time per request (in seconds)
    • Email Severity: The DBot reputation for compromised emails (SUSPICIOUS or MALICIOUS)
    • Domain Severity: The DBot reputation for compromised domains (SUSPICIOUS or MALICIOUS)
    • Trust any certificate (not secure)
    • Use system proxy settings
  4. Click Test to validate the URLs, token, and connection.

Fetched Incidents Data

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. pwned-email
  2. pwned-domain
  3. email
  4. domain
  5. pwned-username

1. pwned-email

Checks if an email address was compromised.

Base Command

pwned-email

Input
Argument Name Description Required
email Comma-separated list of email addresses to check. Required
Context Output
Path Type Description
Account.Email.Pwned-V2.Compromised.Vendor String For compromised email addresses, the vendor that made the decision.
Account.Email.Pwned-V2.Compromised.Reporters String For compromised email addresses, the reporters for the vendor to make the compromised decision.
Account.Email.Address String The email address.
Email.Malicious.Vendor String For malicious email addresses, the vendor that made the decision.
Email.Malicious.Description String For malicious email addresses, the reason that the vendor made the decision.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String Vendor used to calculate the score.
DBotScore.Score Number The actual score.
Command Example

!pwned-email email="michaljordan@gmail.com"

Context Example
{
    "DBotScore": {
        "Vendor": "Have I Been Pwned? V2", 
        "Indicator": "michaljordan@gmail.com", 
        "Score": 2, 
        "Type": "email"
    }, 
    "Account.Email": {
        "Pwned-V2": {
            "Compromised": {
                "Vendor": "Have I Been Pwned? V2", 
                "Reporters": "Canva, Dubsmash, Modern Business Solutions, Straffic, TestGame"
            }
        }, 
        "Address": "michaljordan@gmail.com"
    }
}
Human Readable Output

Have I Been Pwned query for email: michaljordan@gmail.com

Canva (canva.com): 137272116 records breached [Verified breach]

Date: 2019-05-24

In May 2019, the graphic design tool website Canva suffered a data breach that impacted 137 million subscribers. The exposed data included email addresses, usernames, names, cities of residence and passwords stored as bcrypt hashes for users not using social logins. The data was provided to HIBP by a source who requested it be attributed to “JimScott.Sec@protonmail.com”.
Data breached: Email addresses,Geographic locations,Names,Passwords,Usernames

Dubsmash (dubsmash.com): 161749950 records breached [Verified breach]

Date: 2018-12-01

In December 2018, the video messaging service Dubsmash suffered a data breach. The incident exposed 162 million unique email addresses alongside usernames and PBKDF2 password hashes. In 2019, the data appeared listed for sale on a dark web marketplace (along with several other large breaches) and subsequently began circulating more broadly. The data was provided to HIBP by a source who requested it to be attributed to "BenjaminBlue@exploit.im".
Data breached: Email addresses,Geographic locations,Names,Passwords,Phone numbers,Spoken languages,Usernames

Modern Business Solutions (modbsolutions.com): 58843488 records breached [Verified breach]

Date: 2016-10-08

In October 2016, a large Mongo DB file containing tens of millions of accounts was shared publicly on Twitter (the file has since been removed). The database contained over 58M unique email addresses along with IP addresses, names, home addresses, genders, job titles, dates of birth and phone numbers. The data was subsequently attributed to "Modern Business Solutions", a company that provides data storage and database hosting solutions. They’ve yet to acknowledge the incident or explain how they came to be in possession of the data.
Data breached: Dates of birth,Email addresses,Genders,IP addresses,Job titles,Names,Phone numbers,Physical addresses

Straffic (straffic.io): 48580249 records breached [Verified breach]

Date: 2020-02-14

In February 2020, Israeli marketing company Straffic exposed a database with 140GB of personal data. The publicly accessible Elasticsearch database contained over 300M rows with 49M unique email addresses. Exposed data also included names, phone numbers, physical addresses and genders. In their breach disclosure message, Straffic stated that "it is impossible to create a totally immune system, and these things can occur".
Data breached: Email addresses,Genders,Names,Phone numbers,Physical addresses

TestGame (zynga.com): 172869660 records breached [Verified breach]

Date: 2019-09-01

In September 2019, game developer TestGame (the creator of Words with Friends) suffered a data breach. The incident exposed 173M unique email addresses alongside usernames and passwords stored as salted SHA-1 hashes. The data was provided to HIBP by dehashed.com.
Data breached: Email addresses,Passwords,Phone numbers,Usernames

2. pwned-domain

Checks if a domain was compromised.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

pwned-domain

Input
Argument Name Description Required
domain Comma-separated list of domains to check. Required
Context Output
Path Type Description
Domain.Pwned-V2.Compromised.Vendor String For compromised domains, the vendor that made the decision.
Domain.Pwned-V2.Compromised.Reporters String For compromised domains, the reporters for the vendor to make the compromised decision.
Domain.Name String Domain name.
Domain.Malicious.Vendor String For malicious domains, the vendor that made the decision.
Domain.Malicious.Description String For malicious domains, the reason that the vendor made the decision.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String Vendor used to calculate the score.
DBotScore.Score Number The actual score.
Command Example

!pwned-domain domain="adobe.com"

Context Example
{
    "Domain": {
        "Pwned-V2": {
            "Compromised": {
                "Vendor": "Have I Been Pwned? V2", 
                "Reporters": "Adobe"
            }
        }, 
        "Name": "adobe.com"
    }, 
    "DBotScore": {
        "Vendor": "Have I Been Pwned? V2", 
        "Indicator": "adobe.com", 
        "Score": 2, 
        "Type": "domain"
    }
}
Human Readable Output

Have I Been Pwned query for domain: adobe.com

Adobe (adobe.com): 152445165 records breached [Verified breach]

Date: 2013-10-04

In October 2013, 153 million Adobe accounts were breached with each containing an internal ID, username, email, encrypted password and a password hint in plain text. The password cryptography was poorly done and many were quickly resolved back to plain text. The unencrypted hints also disclosed much about the passwords adding further to the risk that hundreds of millions of Adobe customers already faced.
Data breached: Email addresses,Password hints,Passwords,Usernames

3. email

Checks if an email address was compromised.

Base Command

email

Input
Argument Name Description Required
email Comma-separated list of email addresses to check. Required
Context Output
Path Type Description
Account.Email.Pwned-V2.Compromised.Vendor String For compromised email addresses, the vendor that made the decision.
Account.Email.Pwned-V2.Compromised.Reporters String For compromised email addresses, the reporters for the vendor to make the compromised decision.
Account.Email.Address String The email address.
Email.Malicious.Vendor String For malicious email addresses, the vendor that made the decision.
Email.Malicious.Description String For malicious email addresses, the reason that the vendor made the decision.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
Command Example

!email email="michaljordan@gmail.com"

Context Example
{
    "DBotScore": {
        "Vendor": "Have I Been Pwned? V2", 
        "Indicator": "michaljordan@gmail.com", 
        "Score": 2, 
        "Type": "email"
    }, 
    "Account.Email": {
        "Pwned-V2": {
            "Compromised": {
                "Vendor": "Have I Been Pwned? V2", 
                "Reporters": "Canva, Dubsmash, Modern Business Solutions, Straffic, TestGame"
            }
        }, 
        "Address": "michaljordan@gmail.com"
    }
}
Human Readable Output

Have I Been Pwned query for email: michaljordan@gmail.com

Canva (canva.com): 137272116 records breached [Verified breach]

Date: 2019-05-24

In May 2019, the graphic design tool website Canva suffered a data breach that impacted 137 million subscribers. The exposed data included email addresses, usernames, names, cities of residence and passwords stored as bcrypt hashes for users not using social logins. The data was provided to HIBP by a source who requested it be attributed to “JimScott.Sec@protonmail.com”.
Data breached: Email addresses,Geographic locations,Names,Passwords,Usernames

Dubsmash (dubsmash.com): 161749950 records breached [Verified breach]

Date: 2018-12-01

In December 2018, the video messaging service Dubsmash suffered a data breach. The incident exposed 162 million unique email addresses alongside usernames and PBKDF2 password hashes. In 2019, the data appeared listed for sale on a dark web marketplace (along with several other large breaches) and subsequently began circulating more broadly. The data was provided to HIBP by a source who requested it to be attributed to "BenjaminBlue@exploit.im".
Data breached: Email addresses,Geographic locations,Names,Passwords,Phone numbers,Spoken languages,Usernames

Modern Business Solutions (modbsolutions.com): 58843488 records breached [Verified breach]

Date: 2016-10-08

In October 2016, a large Mongo DB file containing tens of millions of accounts was shared publicly on Twitter (the file has since been removed). The database contained over 58M unique email addresses along with IP addresses, names, home addresses, genders, job titles, dates of birth and phone numbers. The data was subsequently attributed to "Modern Business Solutions", a company that provides data storage and database hosting solutions. They’ve yet to acknowledge the incident or explain how they came to be in possession of the data.
Data breached: Dates of birth,Email addresses,Genders,IP addresses,Job titles,Names,Phone numbers,Physical addresses

Straffic (straffic.io): 48580249 records breached [Verified breach]

Date: 2020-02-14

In February 2020, Israeli marketing company Straffic exposed a database with 140GB of personal data. The publicly accessible Elasticsearch database contained over 300M rows with 49M unique email addresses. Exposed data also included names, phone numbers, physical addresses and genders. In their breach disclosure message, Straffic stated that "it is impossible to create a totally immune system, and these things can occur".
Data breached: Email addresses,Genders,Names,Phone numbers,Physical addresses

TestGame (zynga.com): 172869660 records breached [Verified breach]

Date: 2019-09-01

In September 2019, game developer TestGame (the creator of Words with Friends) suffered a data breach. The incident exposed 173M unique email addresses alongside usernames and passwords stored as salted SHA-1 hashes. The data was provided to HIBP by dehashed.com.
Data breached: Email addresses,Passwords,Phone numbers,Usernames

4. domain

Checks if a domain was compromised.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

domain

Input
Argument Name Description Required
domain Comma-separated list of domains to check. Required
Context Output
Path Type Description
Domain.Pwned-V2.Compromised.Vendor String For compromised domains, the vendor that made the decision.
Domain.Pwned-V2.Compromised.Reporters String For compromised domains, the reporters for the vendor to make the compromised decision.
Domain.Name String The domain name.
Domain.Malicious.Vendor String For malicious domains, the vendor that made the decision.
Domain.Malicious.Description String For malicious domains, the reason that the vendor made the decision.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String Vendor used to calculate the score.
DBotScore.Score Number The actual score.
Command Example

!domain domain="adobe.com"

Context Example
{
    "Domain": {
        "Pwned-V2": {
            "Compromised": {
                "Vendor": "Have I Been Pwned? V2", 
                "Reporters": "Adobe"
            }
        }, 
        "Name": "adobe.com"
    }, 
    "DBotScore": {
        "Vendor": "Have I Been Pwned? V2", 
        "Indicator": "adobe.com", 
        "Score": 2, 
        "Type": "domain"
    }
}
Human Readable Output

Have I Been Pwned query for domain: adobe.com

Adobe (adobe.com): 152445165 records breached [Verified breach]

Date: 2013-10-04

In October 2013, 153 million Adobe accounts were breached with each containing an internal ID, username, email, encrypted password and a password hint in plain text. The password cryptography was poorly done and many were quickly resolved back to plain text. The unencrypted hints also disclosed much about the passwords adding further to the risk that hundreds of millions of Adobe customers already faced.
Data breached: Email addresses,Password hints,Passwords,Usernames

5. pwned-username

Checks if a username was compromised.

Base Command

pwned-username

Input
Argument Name Description Required
username Comma-separated list of usernames to check. Required
Context Output
Path Type Description
Username.Pwned-V2.Compromised.Vendor String For compromised usernames, the vendor that made the decision.
Username.Pwned-V2.Compromised.Reporters String For compromised usernames, the reporters for the vendor to make the compromised decision.
Username.Name String The username name.
Username.Malicious.Vendor String For malicious usernames, the vendor that made the decision.
Username.Malicious.Description String For malicious usernames, the reason that the vendor made the decision.
Command Example

!pwned-username username="jondon"

Context Example
{
    "Domain": {
        "Pwned-V2": {
            "Compromised": {
                "Vendor": "Have I Been Pwned? V2", 
                "Reporters": "Gawker, hackforums.net"
            }
        }, 
        "Name": "jondon"
    }, 
    "DBotScore": {
        "Vendor": "Have I Been Pwned? V2", 
        "Indicator": "jondon", 
        "Score": 2, 
        "Type": "domain"
    }
}
Human Readable Output

Have I Been Pwned query for username: jondon

Gawker (gawker.com): 1247574 records breached [Verified breach]

Date: 2010-12-11

In December 2010, Gawker was attacked by the hacker collective "Gnosis" in retaliation for what was reported to be a feud between Gawker and 4Chan. Information about Gawkers 1.3M users was published along with the data from Gawker’s other web presences including Gizmodo and Lifehacker. Due to the prevalence of password reuse, many victims of the breach then had their Twitter accounts compromised to send Acai berry spam.
Data breached: Email addresses,Passwords,Usernames

hackforums.net (hackforums.net): 191540 records breached [Verified breach]

Date: 2011-06-25

In June 2011, the hacktivist group known as “LulzSec” leaked one final large data breach they titled “50 days of lulz”. The compromised data came from sources such as AT&T, Battlefield Heroes and the hackforums.net website. The leaked Hack Forums data included credentials and personal information of nearly 200,000 registered forum users.
Data breached: Dates of birth,Email addresses,Instant messenger identities,IP addresses,Passwords,Social connections,Spoken languages,Time zones,User website URLs,Usernames,Website activity

Configuration parameters

  • api_key — API Key
  • credentials_api_key —
  • max_retry_time — Maximum time per request (in seconds)
  • default_dbot_score_email — Email Severity: The DBot reputation for compromised emails (SUSPICIOUS or MALICIOUS)
  • default_dbot_score_domain — Domain Severity: The DBot reputation for compromised domains (SUSPICIOUS or MALICIOUS)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • integrationReliability — Source Reliability
  • feedExpirationPolicy —
  • feedExpirationInterval —

Commands (5)

  • domain

    Checks if a domain was compromised.

  • email

    Checks if an email address was compromised.

  • pwned-domain

    Checks if a domain was compromised.

  • pwned-email

    Checks if an email address was compromised.

  • pwned-username

    Checks if a username was compromised.

Source

PwnedV2.py PwnedV2_test.py PwnedV2.yml PwnedV2_description.md command_examples.txt
Download History Raw 
import sys
from unittest.mock import MagicMock

import demistomock as demisto
import PwnedV2
import pytest
from PwnedV2 import error_handler, pwned_domain_command, pwned_email_command, pwned_username_command

RETURN_ERROR_TARGET = "PwnedV2.return_error"

username_context = {
    "Domain(val.Name && val.Name == obj.Name)": {
        "Name": "jondon",
        "Pwned-V2": {"Compromised": {"Vendor": "Have I Been Pwned? V2", "Reporters": "Gawker, hackforums.net"}},
        "Malicious": {"Vendor": "Have I Been Pwned? V2", "Description": "The domain has been compromised"},
    },
    "DBotScore": {
        "Indicator": "jondon",
        "Type": "domain",
        "Vendor": "Have I Been Pwned? V2",
        "Score": 3,
        "Reliability": "A - Completely reliable",
    },
}

domain_context = {
    "Domain(val.Name && val.Name == obj.Name)": {
        "Name": "adobe.com",
        "Pwned-V2": {"Compromised": {"Vendor": "Have I Been Pwned? V2", "Reporters": "Adobe"}},
        "Malicious": {"Vendor": "Have I Been Pwned? V2", "Description": "The domain has been compromised"},
    },
    "DBotScore": {
        "Indicator": "adobe.com",
        "Type": "domain",
        "Vendor": "Have I Been Pwned? V2",
        "Score": 3,
        "Reliability": "A - Completely reliable",
    },
}

username_req = [
    {
        "PwnCount": 1247574,
        "Domain": "gawker.com",
        "IsSensitive": False,
        "Name": "Gawker",
        "Title": "Gawker",
        "DataClasses": ["Email addresses", "Passwords", "Usernames"],
        "IsRetired": False,
        "IsSpamList": False,
        "BreachDate": "2010-12-11",
        "IsFabricated": False,
        "ModifiedDate": "2013-12-04T00:00:00Z",
        "LogoPath": "https://haveibeenpwned.com/Content/Images/PwnedLogos/Gawker.png",
        "AddedDate": "2013-12-04T00:00:00Z",
        "IsVerified": True,
        "Description": "In December 2010, Gawker was attacked by the hacker collective "Gnosis""
        " in retaliation for what was"
        " reported to be a feud between Gawker and 4Chan. Information about Gawkers 1.3M users was published along"
        " with the data from Gawker's other web presences including Gizmodo and Lifehacker. Due to the prevalence of"
        ' password reuse, many victims of the breach <a href="http://www.troyhunt.com/2011/01/why-your-apps-security'
        '-design-could.html" target="_blank" rel="noopener">then had their Twitter accounts compromised to send Acai'
        " berry spam</a>.",
    },
    {
        "PwnCount": 191540,
        "Domain": "hackforums.net",
        "IsSensitive": False,
        "Name": "HackForums",
        "Title": "hackforums.net",
        "DataClasses": [
            "Dates of birth",
            "Email addresses",
            "Instant messenger identities",
            "IP addresses",
            "Passwords",
            "Social connections",
            "Spoken languages",
            "Time zones",
            "User website URLs",
            "Usernames",
            "Website activity",
        ],
        "IsRetired": False,
        "IsSpamList": False,
        "BreachDate": "2011-06-25",
        "IsFabricated": False,
        "ModifiedDate": "2014-05-11T10:30:43Z",
        "LogoPath": "https://haveibeenpwned.com/Content/Images/PwnedLogos/HackForums.png",
        "AddedDate": "2014-05-11T10:30:43Z",
        "IsVerified": True,
        "Description": 'In June 2011, the hacktivist group known as "LulzSec" leaked <a href='
        '"http://www.forbes.com/sites/andygreenberg/2011/06/25/lulzsec-says-goodbye-'
        'dumping-nato-att-gamer-data/" target="_blank" rel="noopener">one final large'
        ' data breach they titled "50 days of lulz"</a>. The compromised data came from'
        ' sources such as AT&T, Battlefield Heroes and the <a href="http://hackforums.'
        'net" target="_blank" rel="noopener">hackforums.net website</a>. The leaked '
        "Hack Forums data included credentials and personal "
        "information of nearly 200,000 registered forum users.",
    },
]

domain_req = [
    {
        "PwnCount": 152445165,
        "Domain": "adobe.com",
        "IsSensitive": False,
        "Name": "Adobe",
        "Title": "Adobe",
        "DataClasses": ["Email addresses", "Password hints", "Passwords", "Usernames"],
        "IsRetired": False,
        "IsSpamList": False,
        "BreachDate": "2013-10-04",
        "IsFabricated": False,
        "ModifiedDate": "2013-12-04T00:00:00Z",
        "LogoPath": "https://haveibeenpwned.com/Content/Images/PwnedLogos/Adobe.png",
        "AddedDate": "2013-12-04T00:00:00Z",
        "IsVerified": True,
        "Description": "In October 2013, 153 million Adobe accounts were breached with each"
        " containing an internal ID, username, email, <em>encrypted</em> password and"
        " a password hint in plain text. The password cryptography was poorly done"
        ' and <a href="http://stricture-group.com/files/adobe-top100.txt" target="_'
        'blank" rel="noopener">many were quickly resolved back to plain text</a>. '
        'The unencrypted hints also <a href="http://www.troyhunt.com/2013/11/adobe-'
        'credentials-and-serious.html" target="_blank" rel="noopener">disclosed much'
        " about the passwords</a> adding further to the risk that hundreds of "
        "millions of Adobe customers already faced.",
    }
]

args1 = {"username": "jondon", "domain": "adobe.com"}


@pytest.mark.parametrize(
    "command, args, response, expected_result",
    [(pwned_username_command, args1, username_req, username_context), (pwned_domain_command, args1, domain_req, domain_context)],
)
def test_pwned_commands(command, args, response, expected_result, mocker):
    """Unit test
    Given
    - command args - e.g username, mail
    - response of the database
    When
    - mock the website result
    Then
    - convert the result to human readable table
    - create the context
    validate the expected_result and the created context
    """
    PwnedV2.API_KEY = "test"
    mocker.patch.object(
        demisto,
        "params",
        return_value={"integrationReliability": "A - Completely reliable", "credentials_api_key": {"password": "test"}},
    )
    mocker.patch("PwnedV2.http_request", return_value=response)
    md_list, ec_list, api_email_res_list = command(args)
    for _hr, outputs, _raw in zip(md_list, ec_list, api_email_res_list):
        assert expected_result == outputs  # entry context is found in the 2nd place in the result of the command


def test_valid_emails(mocker):
    """
    Given:
    - A list of valid email addresses.

    When:
    - Calling the pwned_email_command function.

    Then:
    - Ensure the function returns the expected output.
    """
    email_list = ["test1@example.com", "test2@example.com"]
    api_email_res_list = [
        {
            "Title": "Breach1",
            "Domain": "example.com",
            "PwnCount": 100,
            "IsVerified": True,
            "BreachDate": "2021-01-01T00:00:00Z",
            "Description": "<p>Breach description</p>",
            "DataClasses": ["Emails", "Passwords"],
        },
        None,
    ]
    api_paste_res_list = [
        [{"Source": "Paste1", "Title": "Paste Title", "Id": "1234", "Date": "2021-01-01T00:00:00Z", "EmailCount": 10}],
        [],
    ]
    expected_md_list = [
        "### Have I Been Pwned query for email: *test1@example.com*\n"
        "#### Breach1 (example.com): 100 records breached [Verified breach]\n"
        "Date: **2021-01-01**\n\n"
        "Breach description\n"
        "Data breached: **Emails,Passwords**\n"
        "\n"
        'The email address was found in the following "Pastes":\n'
        "| ID | Title | Date | Source | Amount of emails in paste |\n"
        "|----|-------|------|--------|--------------------------|\n"
        "| 1234 | Paste Title | 2021-01-01 | Paste1 | 10 |\n",
        "### Have I Been Pwned query for email: *test2@example.com*\nNo records found",
    ]
    expected_ec_list = [
        {
            "DBotScore": {
                "Indicator": "test1@example.com",
                "Type": "email",
                "Vendor": "HaveIBeenPwned",
                "Score": 3,
                "Reliability": "B - Usually reliable",
            },
            "email": {
                "Address": "test1@example.com",
                "Pwned-V2": {"Compromised": {"Vendor": "HaveIBeenPwned", "Reporters": "Breach1, Paste1"}},
                "Malicious": {"Vendor": "HaveIBeenPwned", "Description": "The email has been compromised"},
            },
        },
        {
            "DBotScore": {
                "Indicator": "test2@example.com",
                "Type": "email",
                "Vendor": "HaveIBeenPwned",
                "Score": 0,
                "Reliability": "B - Usually reliable",
            },
            "email": {"Address": "test2@example.com", "Pwned-V2": {"Compromised": {"Vendor": "HaveIBeenPwned", "Reporters": ""}}},
        },
    ]

    mocker.patch.object(demisto, "params", return_value={"integrationReliability": "B - Usually reliable"})
    mocker.patch.object(demisto, "command", return_value="pwned-email")
    mocker.patch.object(demisto, "args", return_value={"email": email_list})
    mocker.patch("PwnedV2.pwned_email", return_value=(api_email_res_list, api_paste_res_list))
    mocker.patch("PwnedV2.data_to_markdown", side_effect=expected_md_list)
    mocker.patch("PwnedV2.email_to_entry_context", side_effect=expected_ec_list)

    md_list, ec_list, api_paste_res = pwned_email_command(demisto.args())

    assert md_list == expected_md_list
    assert ec_list == expected_ec_list


def test_error_handler_404():
    # Mock response object with 404 status code
    res = MagicMock()
    res.status_code = 404

    with pytest.raises(Exception) as excinfo:
        error_handler(res)

    assert str(excinfo.value) == "No result found."


def test_error_handler_other_status_code(mocker):
    # Mock response object with non-404 status code
    res = MagicMock()
    res.status_code = 500
    res.text = "Internal Server Error"

    mocker.patch.object(sys, "exit")
    mocker.patch.object(demisto, "error")
    mocker.spy(demisto, "results")

    expected_message = "Error in API call to Pwned Integration"

    error_handler(res)

    assert expected_message in demisto.results.call_args.args[0].get("Contents")