A monitoring apparatus, comprising: a storage unit arranged to store history information regarding login attempts to a system by a communication apparatus from a plurality of transmission source addresses (srcIP1, srclP2, srclP3), the system being a target to be monitored, wherein the storage unit is arranged to store, as the history information, each of the plurality of transmission source addresses in association with an address of the system and a respective login attempt count being a number of login attempts from the respective transmission source address to the address of the system; an extracting unit arranged to extract, from the history information, at least one of a respective variance of the number of login attempts per unit time and a respective length of a time of the login attempts from each of the plurality of transmission source addresses (srclP1, srclP2, srclP3); a determining unit arranged to determine whether an attack, in which an address of the communication apparatus is changed from a first address of the plurality of transmission source addresses (srclP1, srclP2, srclP3) to a second address of the plurality of transmission source addresses (srclP1, srclP2, srclP3), and the communication apparatus attempts accesses to the system from each of the first address and the second address, was executed on the system, by determining whether the at least one of the variance and the length of the time of login attempts from the first and second addresses is substantially the same; and an output unit arranged to add, when it is determined that the attack was executed, the address of the system to a list that manages systems that had the attack. a storage unit arranged to store history information regarding login attempts to a system by a communication apparatus from a plurality of transmission source addresses (srcIP1, srclP2, srclP3), the system being a target to be monitored, wherein the storage unit is arranged to store, as the history information, each of the plurality of transmission source addresses in association with an address of the system and a respective login attempt count being a number of login attempts from the respective transmission source address to the address of the system; an extracting unit arranged to extract, from the history information, at least one of a respective variance of the number of login attempts per unit time and a respective length of a time of the login attempts from each of the plurality of transmission source addresses (srclP1, srclP2, srclP3); a determining unit arranged to determine whether an attack, in which an address of the communication apparatus is changed from a first address of the plurality of transmission source addresses (srclP1, srclP2, srclP3) to a second address of the plurality of transmission source addresses (srclP1, srclP2, srclP3), and the communication apparatus attempts accesses to the system from each of the first address and the second address, was executed on the system, by determining whether the at least one of the variance and the length of the time of login attempts from the first and second addresses is substantially the same; and an output unit arranged to add, when it is determined that the attack was executed, the address of the system to a list that manages systems that had the attack.