Money laundering is the key here - you have it going out of one account to another one... registered in Micronesia that just happens to have been emptied yester

Money laundering is the key here - you have it going out of one account to another one... registered in Micronesia that just happens to have been emptied yesterday and closed. The QR code and URL (essentially the same piece of information) point to a server somewhere that could be some idiot running it on their personal real-name AWS account but is probably a dead end of the server host either being shifty/ignorant and accepting cash with no contact details or having given the server out to someone with entirely fraudulent contact details. It's possible if they're greedy the money trail will be easy to follow, but if they're willing to lose a large proportion of their earnings passing it through some people that can launder money well then they'll probably get off scot free.