I wonder if these attacks, along with some clever fingerprinting of the server host, and advanced techniques on traffic correlation, were enough to determine the whereabouts of the servers:

http://www.ieee-security.org/TC/SP2013/papers/4977a080.pdf

http://www.cl.cam.ac.uk/~sjm217/papers/ccs06hotornot.pdf