From my experience this is more likely to be an SQL injection attack or similar, rather than a successful guess of your FTP password. I've not used plesk so don't know about raw apache logs but that's where you want to be looking. Check for long requests, especially ones with odd looking characters in.

Hi Ben,

We're not talking about password guessing but password capture. The payload for this particular iframe includes an infected pdf file designed to do exactly that (and worse).

It could be a hybrid attack, using either password capture or SQL injection, depending on the host, but the xfer logs are likely to be much shorter than the access logs, so that's the quickest thing to eliminate or confirm.

At least safe mode is set on PAYH.

Gabe

@Gabe, I will have a look at the xfer logs as soon as I can!