It is not that they know when a new droplet is spun up. Rather these are automated scans or botnets that are scanning whole blocks of IP addresses. You will see this type of thing with any server you place on the public Internet.

Hi Jason,

I just got a droplet myself, first one, just to play with. When I went to monitor the traffic hitting it, I’ve been very surprised. I guess that shows that I’m not a network admin, but I’ve logged over 15k unique ip connection attempts to my ip port 22 the last 24 hours (or about 10 per minute). I was thinking exactly what you said “security must be a nightmare”.

gp+digitalocean has been responding to me also.

https://www.digitalocean.com/community/questions/network-analyzer-constant-flow-of-icmp-packets-to-myip-ssh?comment=39798