A while ago someone from TPB guys explained their setup. Their web-facing webservers connect to the actual backends via a VPN that does some fancy routing to hide the real location. On top of that, they have a ton of mirrors and proxies running.