There have been fraudulently obtained passes sold on the dark web. There have also been numerous arrests throughout the whole of Europe for this.

The vast majority of the dark-web suppliers are scammers - many of the adverts include a mix of QRs people have posted to social media and a large number of example QR. Including examples that I have generated in the past and used in presentations / on github.