I am very interested in finding out how they were able to know with certainty that the server was located in Lithuania. I didn't find this mentioned in any reporting of the Hansa takedown and I see a handful of commenters on Krebs asking the same question.