@wayne-workman ```

user@server:~$ ls -laht /var/www total 12K drwxr-xr-x 3 root root 4.0K Sep 1 09:25 html drwxr-xr-x 3 root root 4.0K Aug 19 10:27 . lrwxrwxrwx 1 root root 18 Aug 19 10:27 fog -> /var/www/html/fog/ drwxr-xr-x 12 root root 4.0K Aug 18 09:58 .. user@server:~$ ls -laht /var/www/html total 28K drwxr-xr-x 11 www-data www-data 4.0K Sep 1 09:25 fog drwxr-xr-x 3 root root 4.0K Sep 1 09:25 . drwxr-xr-x 3 root root 4.0K Aug 19 10:27 .. -rw-r--r-- 1 www-data www-data 52 Aug 19 10:27 index.php -rw-r--r-- 1 root root 11K Aug 18 10:01 index.html

@Sebastian-Roth Makes sense to me.
Solved for me

@Sebastian-Roth So after taking your advice on the multiple DHCP servers, I went and checked for any possible Rogue DHCP servers using Wireshark, and I found a range that is not apart of our usual subnet, was offering and broadcasting DHCP. So the issue was rogue DHCP.