This question already has an answer here:
As titled, we discovered some unknown IP address is accessing our API Server.
We have set up an AWS EC2 instance as an API server. The API server URL is only used in our mobile app. However, our mobile app has not been released yet and the API server URL is not linked from any public website.
We can see the (multiple) attackers are randomly trying the URL path,
i.e. /admin/i18n/readme.txt /a2billing/admin/Public/index.php /current_config/passwd /recordings/ /.git/objects
How do they discover our server really?