The internet in Iran was partially reconnected since May 26th: Doug Madory: "Seeing the first signs of a possible internet res…" - Infosec Exchange, but with many websites and online services blocked. So I suspect the snowflake traffic is coming from Iranian users.