Thanks, any improvements (especially on the sed) let me know, i'm ad-libbing :)
Another possible point is to see if you can restrict plesk control panel to your ip or at least the port.
Ok just registered so I could add to this - exact same hack attempt here.
If its already happened - here's some tips.
Find the files that have been modified in the past day within vhost, try -
find /var/www/vhosts \( -name "*.js" -o -name "*.php" -o -name "index.*" -o -name...