An unusual spike in API calls to the contact importer feature was detected, indicating a potential exploitation attempt to gain unauthorized access to user data. The activity appears to originate from a known malicious IP address.