Inside the X2236 HQ MIX Combolist: How 2,235 Logins Got Leaked

Inside the X2236 HQ MIX Combolist

On July 30, 2026, HEROIC analysts identified a combolist named "X2236 HQ MIX" shared on Telegram. The file contains 2,235 records, each pairing an email address or username with a plaintext password and the URL the credentials were used on.

Why This Is Dangerous

Every one of the 2,235 passwords in this file is stored in plaintext, meaning there is no encryption standing between an attacker and a usable login. Anyone who downloads the X2236 HQ MIX file can immediately begin testing the credentials against email providers, shopping sites, and banking portals.

What Was Exposed in the X2236 HQ MIX Leak

• Email addresses and usernames
• Plaintext passwords (not hashed or encrypted)
• URLs tied to each set of credentials

Why This Matters if You Reuse Passwords

Mixed combolists like this one are used almost exclusively for credential stuffing, testing the same email and password pair across dozens of other websites at once. If your credentials are among the 2,235 records here and you reuse passwords, an attacker could pivot from this leak into account takeover, identity theft, or financial fraud on completely unrelated accounts.

How a "Combolist" Like X2236 HQ MIX Gets Built

A combolist is simply a large text file combining login credentials pulled from multiple sources, older breaches, phishing kits, and malware logs, merged together and cleaned up so buyers get a higher rate of working logins. The word "mix" in the name signals that this file was combined from more than one original source rather than pulled from a single incident. That is what makes combolists different from a single company's breach: they are compiled products, not a single event.

Check If You Are Affected

Rather than guess whether your email is part of the X2236 HQ MIX file, check directly. HEROIC's free breach scanner searches more than 400 billion leaked records, including combolists like this one, so you can see your exposure in seconds and update any reused password right away.