Where do the QR codes for Super Mystery Dungeon come from?

They were put out by Nintendo themselves, on the official site, in magazines and at events, and people collected them into galleries. The scanning is done with the 3DS camera on the in-game QR screen, nothing goes online, so they still work now the servers are gone. I believe they're region-specific though, so make sure you're grabbing codes meant for your version. Same system does the rescue passwords.