An Aldi Bonus Box sounds like a harmless loyalty perk, until you look up the web address that carries the offer and find a domain barely three days old.
We checked when it was registered, where it sends visitors and whether Aldi has any part in it, and we stopped at the first redirect on purpose.
Overview
What the Aldi Bonus Box address does
We requested aldibonusbox.com five times, and every request came back as a 302 redirect, so the address never shows a page of its own.
The redirect points to shoppinginfohub.com, a different domain, with five campaign labels attached that read like the columns of a marketing dashboard and not like anything from a grocery store.
No address in the chain belongs to Aldi, whose own help center tells shoppers that an ALDI gift card is bought in a local store.
What the registry shows about the domain
Verisign’s registry record lists aldibonusbox.com as registered through NameCheap on November 7, 2026 at 22:05 UTC, with Cloudflare name servers and a transfer lock.
The record changed again at 22:07 UTC, only 82 seconds after registration, which suggests a domain set up in one sitting for a campaign, not a business.
When we looked on November 10, the domain was less than three days old, and the public record names no registrant, only the registrar’s abuse contact.
What we could not see
We did not open the page behind the redirect, enter a phone number or a card, or contact the sender, so we cannot describe the form a visitor would meet.
- Verified by us: the registration date, the name servers, the redirect target, the campaign labels and the absence of any Aldi domain in the chain.
- Not found: an Aldi page that mentions this offer, a named owner for the domain, or a company that stands behind the redirect.
- Not verified: what the landing page asks for, what it charges, and who ends up holding the data a visitor types.
Our advice is not to visit the address, and to read the response section below if you already did.
How the Aldi Bonus Box Scam Works
Step 1: A familiar name does the talking
The offer borrows Aldi’s name because a free grocery box needs no explanation, and a recipient who shops there has little reason to doubt it.
The redirect labels its traffic VOICE_MATILDA and RVM-V2, which look like a synthetic voice and a ringless voicemail batch, so the pitch probably reaches phones as a recording.
That is our reading of two abbreviations and not a confirmation, but the other labels point the same way.
NOV-ALDI-V1-SHORT looks like the script itself, a November Aldi message in a short first version, and aldibonusbox_com names the lure domain that fed the traffic.
The fifth label, KYLE_DATA, resembles the name of a contact list, which would mean a phone number was collected or bought before any message went out.
Step 2: A web address built for the occasion
The name is built from three plain words, Aldi, bonus and box, joined without hyphens, so it is easy to read aloud, type and mistake for a brand page.
The registry shows a one-year registration made on a Saturday evening, three days before we looked, with Cloudflare handling the name servers.
Cloudflare hides the real hosting server and serves millions of ordinary sites, so it tells us nothing about who is behind this one.
The domain’s mail records point to the registrar’s free forwarding service, so it was prepared to receive mail without running a mail server of its own.
Step 3: The address hands you to someone else
A real brand page answers its own front door with content, yet this address sent every one of our requests, with or without an added path, to the same destination.
That destination was shoppinginfohub.com/s2/, with the values a=3660 and s=us-alalmtbx followed by the five labels we described above.
Shoppinginfohub.com was registered on March 7, 2025 through NameSilo, about 20 months before the lure domain existed, and it also sits behind Cloudflare.
The age gap suggests the landing side is a reusable setup into which new lure domains are plugged, which is our inference and not something the records state.
Step 4: A tracking link behind a bot check
Our domain checker followed the chain one step further, to a tracking link on assetprime.su carrying offer_id=759 and aff_id=1615, plus the same us-alalmtbx and 3660 values.
That tracking link answered our automated request with a Cloudflare Attention Required page, and we did not try to get around it.
The shared values on both hops show one campaign running through two domains, so the redirect is a designed path and not a random forward.
Offer and affiliate numbers like these let a network credit a sign-up or a sale to whoever sent the traffic, but we do not know whose account 1615 is.
Step 5: Where the money likely comes from
In affiliate marketing the sender is normally paid when a visitor completes an action, such as answering a survey, starting a trial or paying a small fee.
That model needs a hook that costs the sender almost nothing, and a free box from a trusted grocer is about as cheap and effective as hooks get.
We could not see which action the landing page asks for, so this payoff is inferred from the structure of the chain and not observed.
What the structure does show is that the visitor’s attention is being sold onward, and that Aldi is not the party collecting anything.
Is Aldi Behind the Bonus Box?
We searched Aldi’s US help center for the word scam and got zero results, so we found no Aldi notice about this offer or any similar one.
The home page of that help center does give a plain answer on one point, because it directs shoppers to a local store to buy an ALDI gift card.
Those tiles cover FAQs, gift card balances and careers, and the trending questions concern stock, overcharges and online orders, with nothing about rewards or bonus boxes.
A missing warning does not prove Aldi stayed out of it, so the stronger evidence is structural: Aldi’s name sits in the domain while the path leads to trackers.
Not one address in the chain is an aldi.us address, and the lure domain was registered through a retail registrar a few days before we looked.
A real Aldi promotion would be easy to confirm on Aldi’s own site or customer service line, so anything you can only reach through an unsolicited message deserves doubt.
The Spellings We Checked
Someone who hears an offer read aloud may type the name from memory and drop a letter, so we checked the likeliest variants of the web address.
The version without the d, alibonusbox.com, is not registered: DNS answers NXDOMAIN and the registry returns a not-found response, so it leads nowhere.
The shorter alibonus.com is registered and does resolve, but it redirects to megabonus.com, a cash back service whose page title promises refunds on online purchases.
We found nothing that ties alibonus.com to the Aldi offer, so treat it as an unrelated site and do not connect it to this case.
Only the spelling that includes Aldi’s full name triggers the campaign redirect, and that is the one registered three days before our check.
Every variant we tried came from the name as people say it, and we did not guess any hidden paths on the live domain.
How to Check a Link Like This Yourself
You can repeat our first check in under a minute, because the Verisign registry record for any .com address lists its registration date and registrar, as in this example.
A brand’s real site is usually years old, so a brand-name domain registered last week is a reason to stop, whatever the message promises.
Compare the spelling letter by letter with the company’s own address, and be suspicious of any extra words such as bonus, reward, benefits or box.
Finally, read the redirect and stop there: the address you were given is the evidence, and the page it leads to is where the risk begins.
What the Shared Codes Do and Do Not Tell Us
Shared values show a common setup, not proven common ownership, so we are not attaching a name to the numbers we found.
The campaign value 3660 and the code us-alalmtbx appear on two domains, and the offer number 759 and affiliate number 1615 appear on the tracking link.
Anyone with access to the affiliate network could tell whose account those numbers belong to, which is why a report to the network is useful once the network is identified.
The registry offers a thinner route, because its only listed contact is the registrar’s abuse desk at NameCheap, where reports about a domain borrowing a brand name belong.
The domain is also new enough that a takedown would remove very little history, which is exactly why campaigns like this register another one.
What You Risk Depending on What You Entered
You only received the message
Receiving the message costs nothing by itself, but replying or pressing a key tells the sender that your number is live and attended.
Delete it, block the number and report it, and expect the same offer to return under a different domain.
You opened the link
Because we never opened the landing page, we cannot say it installs anything, and a page view alone rarely harms a phone with current updates.
Even a page view can hand your phone model and rough location to the networks along the chain, so close the page and do not return.
You typed contact details
A name, address and phone number can be reused for marketing long after the offer, and they make later phone and email lures more convincing.
Watch for follow-up messages that mention your name or a delivery, and ignore anything that asks you to confirm a code.
You entered card details
A card number paid for a small shipping fee or a trial is the highest-risk case, because the same details can be charged again or sold.
Act through your card issuer quickly, and read the response steps below in order, starting with the card.
What to Do If You Responded
-
Stop interacting. Do not reply, press keys on the recording or call a number back, because each response confirms that your line is active.
-
Block and report. Forward the text to 7726 (SPAM), report it in your messaging app and block the sender.
-
Save what you saw. Take screenshots of the message and any page you opened, and note the date, time and sender before you delete anything.
-
Call your card issuer. If you entered card details, use the number on the back of the card, cancel it and ask for a new card number.
-
Review your statements. Look for small unfamiliar charges and monthly renewals over the next 90 days, and dispute each one you did not approve.
-
Use the dispute route. Send your issuer a written dispute within 60 days of the statement that shows the charge.
-
Protect your identity. If you typed a date of birth or ID number, freeze your credit with the three bureaus and change any password you reused.
-
Report the offer. File at ReportFraud.ftc.gov, name aldibonusbox.com and shoppinginfohub.com, and tell Aldi through its help center.
Frequently Asked Questions
Is the Aldi Bonus Box real?
We found no Aldi page, notice or reward program that matches it, and the web address behind it is a new domain that hands visitors to a tracking network.
Is aldibonusbox.com safe to open?
We would not open it, because it sends visitors to third-party tracking links and we could not see what the final page requests or installs.
Did Aldi send the message?
We could not trace a sender, but nothing in the chain is an aldi.us address, and Aldi’s help center points to stores for gift cards.
Is alibonus.com part of this?
We found no link: it redirects to megabonus.com, a cash back service, and it is a different spelling from the one that triggers the campaign redirect.
What do the redirect labels mean?
We read them as a synthetic voice, a ringless voicemail batch, a November Aldi script and a contact list, but that is our interpretation and not a confirmed fact.
Can I get my money back after paying a fee?
Contact your card issuer at once and dispute the charge in writing, since card disputes have deadlines and the sender has no reason to help.
The Bottom Line
Do not use the Aldi Bonus Box address: the domain is days old, it forwards visitors to affiliate trackers, and Aldi’s own site points to stores for gift cards.
If you want an Aldi reward, check Aldi’s website or customer service line, and treat any free box that arrives by recorded message as a marketing funnel until proven otherwise.
If you already entered card details, call your issuer today, ask for a new card, dispute any charge and then report the offer.
Join the discussion
0 commentsShare your experience or ask a question about this article.
Discussion
Start the conversation
Have a question or something useful to share? Add the first comment.