The Sticker Doesn't Lie, But the Redirect Does: We Scanned 200 Adult QR Codes in Six Cities

There's a particular kind of sticker that lives on the inside of a bar bathroom door: two inches square, matte vinyl, a QR code, and maybe a strip of neon tape with a word like “curious” or “tonight” written along the edge. Those stickers have been around for years. In 2026, they are absolutely everywhere — and almost nobody knows where they go.

So in October, we went and scanned a few hundred of them.

How We Did It

Two hundred stickers across six cities: New York, Los Angeles, Chicago, Austin, Miami, and Portland. Four habitats — bar bathroom stalls, lampposts and utility poles, laundromats, and campus bulletin boards. Everything ran through a single burner Android phone on a prepaid SIM, VPN switched off so we'd see what a local sees, screen recording running the whole time.

House rules were strict: no logins, no card numbers, no ID photos, no downloads. Every scan got logged for its first landing domain, the number of hops it took to get there, whether it geo-gated us, and whether the page demanded money before showing a single pixel. We scanned each sticker twice, a week apart, because plenty of them quietly rotate destinations.

The Tally

Here's how the 200 broke down:

• 61 were dead, parked, or sitting on a domain listed for sale.
• 47 went straight to a large aggregator hub — the kind of directory that exists mainly to list hundreds of outbound links.
• 38 ran through affiliate redirect chains of two to five hops.
• 22 were geo-fenced to a state- or city-level landing page.
• 19 landed on a single creator's link page.
• 13 wanted a credit card, an ID photo, or both.

That last bucket is where the afternoon got interesting.

The Redirect Chain Is the Actual Product

Thirty-eight of those stickers never really had a destination. They had a route.

A typical chain looked like this: scan, hit a throwaway domain, bounce to a tracker, land on a “review” page that exists only to shuffle you somewhere else, then finally arrive at a paid network with an affiliate ID stitched into the URL. On two hops, the page we landed on shifted depending on the device's user agent — a phone got one layout, a desktop got something blander, and a Googlebot-looking request got a page about online safety.

That's cloaking, and it's the whole business model. The sticker costs pennies to print. The redirect is the inventory. Somebody is paying per click somewhere down the line, and the sticker is just the top of the funnel.

This is also why we're picky about how links get listed here. A directory that shows you where a link points is doing you a favor. A chain of four strangers between you and the destination is not.

Same Sticker, Different Internet

Twenty-two of the codes handed us a different site than the person next to us would have gotten. A sticker stuck to a laundromat dryer in Miami Beach opened a Florida-flavored hub advertising “local” listings that turned out to be three national networks wearing a palm tree. The same code, scanned later from a Portland IP, produced a totally different skin and a different set of outbound links.

Geo-fencing isn't sinister on its own — plenty of legitimate operators localize by state, mostly for age-verification rules that vary by jurisdiction. But it does mean one sticker can be a dozen different front doors, and it makes the “what am I actually looking at” question much harder to answer from the sidewalk.

The Thirteen That Wanted My Card

Thirteen codes tried to separate us from money or identity before showing anything at all. The patterns were consistent enough to be boring:

• An “age verification” screen demanding a photo of a driver's license plus a selfie.
• A “free trial” that wanted $2.95 up front, with $49.95-a-month buried in a terms link nobody would ever find.
• A “player update” that wanted us to sideload an APK.
• A crypto tip jar standing in for a paywall.
• A chat window that assigned us a “host” within ninety seconds of arrival and started counting down a timer.

We didn't complete any of them. Two of the domains involved had been registered within the previous three weeks, which tells you most of what you need to know.

How to Tell Where a Code Is Taking You

You can't audit a sticker from six inches away, but you can absolutely audit a landing page in ten seconds. A few habits worth building:

1. Expand the URL before you load it. Most phone cameras preview the destination. If it's a string of random consonants with a country-code TLD, expect a chain.
2. Count the hops. One redirect is normal. Four is a shell game.
3. Look for a named operator. Legit adult sites tell you who runs them, publish terms, and list a contact method. A page with no footer, no terms, and no company name is a page with no accountability.
4. Never pay for “verification.” Age checks are a real legal thing in many states. A credit card charge labeled as age verification is not.
5. Never upload an ID to a stranger. Especially not to a site you reached through a bathroom door.
6. Check the domain's age. If a lookup tool says the domain is eleven days old, close the tab.
7. Assume the browser is dirty afterward. Use a browser you can wipe, or better, don't scan personal-life stickers on your daily driver in the first place.

What We're Doing With the Data

We're keeping the map. Over the next few months we'll rescan the same 200 coordinates to see which destinations survive, which rotate, and which quietly turn into something else entirely — because that's the thing about a sticker-based link economy. The vinyl stays put. Everything behind the code is negotiable.

If you spot a sticker that leads somewhere genuinely strange, we want to hear about it. Send the city, the venue type, and where the code dumped you. No ID photos required.