They could have looked at the ip's of bitcoin services and noted those running on a linode. Or collected ip's from bitcoin nodes that their own node has seen and looked up those allocated to linode.