Examining DNS records for all related site hostnames will give you a hint a the topology of the site. You may see multiple IP addresses (which don't necessarily mean multiple physical machine, but often will) and the same or different network addresses, which may hint at how they distribute the load for redundancy or speed reasons.
Examining the HTTP headers of a site's various services will give you a possible idea of the front-end. Are they using a reverse proxy, such as nginx or Varnish, or are you hitting the web servers directly? Are requests for PHP pages coming from a different server (apache) than those for static HTML and image files (nginx,lighttpd , etc.)?
Examining SMTP headers from mails sent from a site will give you more hints.
Traceroutes and pings will yield a little more info.
Of course, much info gathered will be speculation and guessing on your part, because a well configured site will not give out too much info about its internal architecture. What you'd be doing is, in essence, much what a penetration tester would do for certain info. Just make sure to not cross the line and disrupt the site.