A website called MysteryBrand, which seemingly launched late last year (though may have been around longer under a different name), is selling videogame-style lootboxes—there are even color-coded rarity levels—that promise users real products, ranging in value from fidget spinners to Lamborghini Centenarios. Welcome to 2019!

We noticed MysteryBrand after seeing a Motherboard report pointing out that YouTube muppet Jake Paul, among others, is promoting the site to his millions of subscribers. It works just like loot boxes do in games: Before virtually 'opening' a box, you can see the possible contents, and while the most expensive items such as cars, watches, vacations, laptops, and graphics cards are at the top, you'll most likely end up with a common item like a calculator watch or phone case. One $7 gaming-themed box is likely to reveal a keyboard keycap remover or cheap mouse, though it's possible you'll come away with an Alienware laptop.

Once you've opened a box, you can have whatever popped out shipped to your home or 'sell' it back to MysteryBrand. The sell back option is key: when a player receives an item more expensive than they box they purchased, they're tempted to turn it in to try a pricier box. Unless they score something they really want and have it shipped, they can potentially whittle down their credit going for a car or laptop until they're stuck with whatever they got from the last box they opened.

You can also create your own boxes. I put together one which contains only two items: a Lamborghini Centenario, which MysteryBrand values at $2,500,000, and a $1.10 sticker you can put on your toilet that says 'iPoop'. I set the chance of getting a Lambo to .001% and the chance of getting an iPoop sticker to 99.999%. With no referral fee for myself, the auto-calculated cost for the box is $28.48.

The MysteryBrand website itself, as you'd expect, looks far too shady to trust with the acquiring and shipping of a limited edition $2.5 million car. (Where do they intend to get one?)

The text is poorly-written.

It accepts payments from G2A Pay, which is owned by G2A, a Steam key marketplace with a bad reputation.

The listed prices for many items are heavily inflated. MysteryBrand values a Samsung 860 EVO 250GB SSD at $114.38, for instance, when it's actually $53 on Amazon right now.

Incredibly, it reveals the email addresses of some of its supposed 'top winners.'

It's an obviously-slimy operation that is targeting young people who are used to spending on videogame loot boxes, and if the idea takes off, it may affect the present conversations about the legality of videogame loot boxes.

MysteryBrand's TOS puts the onus on the user to determine whether or not the site is legal to use in their jurisdiction, which is silly, because MysteryBrand is the operation that must comply with local laws. In the US, that means complying with state gambling laws, and MysteryBrand may be considered illegal gambling in some states. California, for instance, classifies trading card grab bags as lotteries, which could be expanded to include Lambos and laptops.

Law firm Thompson Coburn sums it up in a 2014 article: "...there are situations in which a grab bag program could violate a state’s gambling statute. One scenario that might raise concerns would be if the prizes had significantly different values. The element of chance may then be present—along with prize and consideration."

One of the arguments against classifying videogame loot boxes as gambling is that the virtual items within them are not commodities and have no monetary value. That's a dubious claim, because even virtual items can be bought and sold, but in most places, loot boxes have thus far staved off legislation. MysteryBrand does away with any ambiguity at all. You can win an item that costs more than what you paid, gaining money, or one that costs less, losing money. Whoever's behind it surely hopes to fly under the radar, but if some Jake Paul-obsessed kid spends 10 grand on keychains, you can bet it'll go to court. If it does, I wonder if virtual loot boxes will take a hit, too.

The last time YouTubers and gambling teamed up there was a bit of trouble: Trevor 'TmarTn' Martin and Tom 'ProSyndicate' Cassell were caught promoting a CS:GO skin betting site without disclosing that they owned it. In this case, Jake Paul included a disclaimer that his MysteryBrand video is sponsored. RiceGum also states that he and MysteryBrand 'teamed up' for his video. Keemstar says he was offered $100,000 to promote the site, but turned it down. It seems FTC regulations are being followed in this case, though that does nothing to address whether or not MysteryBrand is legal to operate at all, or whether these YouTubers should be promoting MysteryBrand to their young audiences. (Yeah, I don't think they should be.)

By the way, if any panicked parents who just looked at their credit card statements are reading this, please note that MysteryBrand's poorly-written TOS contains a double negative which unintentionally guarantees refunds: "The web site under no circumstances does not return the money spent on a mystery box." Your lawyer might like that one.