About two months ago, I deployed an Ubuntu server with as main purpose serving a web app. However, I'm still developing the app and only gave the server IP to my coworker and some friends for testing.  

Yesterday I checked the fail2ban logs and noticed many SSH bruteforce attempts from China, France etc. that dated to before I gave out the IP. I also checked my server access logs and noticed some malicious attempts on URLs from the same IPs, trying to bruteforce SSH. One example of a request they made is myip/otherip/file.php. I'm not sure how to interpret this. I traced back the IP of that server and it's on the same hosting company I'm on.

Question: How did they find out about the IP of the server before I even served the app from it or gave it out?

My guess: I'm guessing it is some bot that keeps trying on different IPs of some pattern that leads to servers of the same hosting company. Is that a correct assumption, or are there other possibilities?

Your guess is likely correct.

The big server hosters have continuous IP ranges from which they assign IPs to their customers. Low budget hosters are frequently used by amateurs who don't know what they are doing, so it's likely that they use easy to guess passwords or set up insecure web applications. This makes these IP ranges valuable targets for black-hats.

When you notice such attacks from within the hosters network, you should report them to the hoster, because this is very likely a breach of the terms of use... or a server from another customers where the black-hats were already successful.
