A post tagged "Scam report" has popped up in r/Scams from user u/Specific-Wait-7630. It's about the site aldi.pondmart[.]shop — the author deliberately "broke" the link with square brackets so nobody clicks it by accident. According to him, the page visually mirrors the real Aldi site almost one-to-one: same logos, same layout, same font — so on a quick look at your phone, the swap is easy to miss. In his assessment, there are two goals: harvesting bank card details, or taking payment for goods nobody will ever ship.

He attached no screenshots or other proof — just the domain.

According to WHOIS, pondmart.shop was registered on April 22, 2026 and updated on October 29, 2026, the registrar is Spaceship, and the owner's details are not publicly disclosed. In other words, the domain showed up about six months before the post, and it's a completely separate platform with no connection to Aldi. As of my check, the aldi.pondmart[.]shop subdomain itself returns a 500 error from nginx, and the root pondmart.shop won't load for me at all — looks like the site has either already gone down or is shutting itself off from scrutiny.

The retailer's own position matters more than any guesswork here. In October 2026, Aldi in Britain publicly answered a customer's question on social media: "This is not a legitimate Aldi site I'm afraid. We do not offer any online services." The same piece describes the case of a 16-year-old who tried to buy his sister a gift on an Aldi clone and lost his money, while other customers were being sold a £29 furniture set. The Aldi UK website is essentially a shopfront — you can't buy anything through it. In Australia, Aldi states outright that the only place their products are sold online is DoorDash, and any other site is illegitimate. In the US, delivery and pickup run through aldi.us and partners — Instacart, DoorDash, Uber Eats — as Aldi says in its own press releases. So the post author's advice to look at the root domain (aldi.us, aldi.co.uk) is sound, with one caveat: in the US, payment often doesn't go to aldi.us directly but to the partner's platform — that's the normal setup, not a sign of a fake.

The scheme itself isn't new and is well documented. In May 2026, Malwarebytes broke down a similar case: a Facebook post about a $10 Aldi meat box, the link hidden in the first comment via the cutt[.]ly shortener — first a script takes a device fingerprint, then redirects to gifts-survey[.]life, a copy of the Aldi site. The analysts there list the tell-tale signs: a too-good-to-be-true price, a sob story along the lines of "my son works at Aldi", a made-up age restriction, and the link sitting not in the post body but in the comments — precisely to slip past automated moderation. In September 2026, a breakdown of Aldi air-fryer clones showed the same mechanics: "aldi" flashes in the address, but the domain is someone else's — something like sell-ukaldi.cindralis15874[.]com — plus pressure tactics like "only 3 left".

Now the practical part — the whole reason posts like this get written. If you've already entered your card details on a suspicious site, call your bank or card issuer right away and change your passwords, especially if you use the same one on other services. It's better to shop via the store's site typed in by hand, not through an ad click. In Australia, Aldi asks people to report such sites to Scamwatch; in Britain, Action Fraud handles it; in the US, it's reportfraud.ftc.gov.