As titled, we discovered some unknown IP address is accessing our API Server.

We have set up an AWS EC2 instance as an API server. The API server URL is only used in our mobile app.
However, our mobile app has not been released yet and the API server URL is not linked from any public website.

We can see the (multiple) attackers are randomly trying the URL path, 

i.e. 
/admin/i18n/readme.txt
/a2billing/admin/Public/index.php
/current_config/passwd
/recordings/
/.git/objects


How do they discover our server really?

The short answer is that many people are scanning everything most of the time. 

Doing so was, some years back, considered impractical, but the combination of better networks, better tools better throughput, and more of the space being in use means that is no longer the case.

For example, Zmap claims on its front page:


  ZMap is capable of performing a complete scan of the IPv4 address space in under 5 minutes, approaching the theoretical limit of ten gigabit Ethernet.


Botnets tend to distribute the same sort of scan across significant numbers of nodes, to achieve a similar result: any given machine on the internet is likely to be scanned at least once a day by a determined attacker/scanner. 

Once a webserver is identified on a given IP, there are all kinds of tools to test well-known paths, and tools that will try and guess at your sitemap. 

In short, welcome to the internet - where obscurity is not security. 

Do consider this in the context of setting up your app/services/widget - in all likelihood, things you would probably prefer to be 'secret' will not be, and defending your assets and resources is necessary. 
