The IP addresses are 100% shared. We host hundreds of thousands of websites completely for free, and using a different IP address for every single one is both crazy expensive and completely unnecessary.
I don’t know exactly how the external IPs are set up. I don’t think they change often. I know that they are not the same as your Website IP, and I think the best way to find the right IP is to use a bit of PHP code to grab it from an IP lookup tool, e.g.
<?php echo file_get_contents('http://ifconfig.me');
In any case, I recommend that you do not rely on IP whitelisting for security if you can avoid it. The IP addresses are not guaranteed to remain consistent, and are definitely shared with other websites. So using actual authentication is a lot more secure and much less likely to break.