I have CentOS 7 VPS and when I entered lsof -i command I've seen some strange connection:
sshd 26422 root 3r IPv4 1081208 0t0 TCP jabber.darkserver.in:ssh->89-64-44-49.dynamic.chello.pl:31675 (ESTABLISHED)
I've checked this site (jabber.darkserver.in) and there was only default page from Microsoft IIS server. When I tried to block this connection with iptables I was disconected from my server, but then I could reconnect which possibly means that iptables were flushed. When I killed process I was disconnected too. May it be some backdoor? If yes, then what should I do? Would be removing it enough, or should I ask my VPS provider to format, and restart my server?