Once I realized that one of the sites was down (syntact error).
I checked the part was signed wrong, and I found an iframe in it with a reference to an other site.
I ran a search with grep on the server, and found the same at another separate user... That's happened.
The ftp log hasn't signed any connection...
I searched in google but I could not find a real solution to the problem.
So one of your website's pages was replaced with another? That could be a sign of a PHP injection vulnerability. Did you develop the websites yourself? If you did, look up PHP injection using Google and you can see whether you have vulnerabilities in your websites.