I checked the audit logs – honestly I couldn’t find anything regarding attempting to update IP address. A bunch of entries were in the logs but they either pertained to DNS record changes — or acme/certbot challenge requests which were due to updating SSL certs.