Have you caught suspicious activity from a third party?

I was reflecting on my career over a glass of bourbon the other night and recalled one time our monitoring alerted us that one of our remote devices was flapping. We noticed a ton of traffic on our interfaces coming from the third party. We called them up immediately and let them know what was happening. We jumped on a conference call together and found out the third party was getting DDoS'd.

Do you have any "welp, I guess I'm joining this cyberwar" moment?