You're talking about attacks by an adversary with a partial view of the network; which is possible, but you actually have to suspect your client and server ahead of time, and in practical terms you have to have control and visibility over a huge amount of network space.
The Tor FAQ may be a good place to have a look, but essentially the attack is possible given:
A bad first of three servers can see encrypted Tor traffic coming from your computer. It still doesn't know who you are and what you are doing over Tor.
A bad third of three servers can see the traffic you sent into Tor. It won't know who sent this traffic.
Someone would have to control at least three servers to make the match, and in practice would have to control many, many more as there's no way of determining which three servers any given connection is going to use in a network circuit.
Now scale this up; you want to just identify popular .onion sites, but you're seeing traffic coming in from IPs and out to IPs. You have no idea, none, which traffic is 'response' traffic, and which is 'request' traffic, you have no idea if those IPs are simply relays that happen to be chosen a few times - it's very possible in this scenario that you never see the IP of any popular .onion sites. Additionally, Tor circuits are built to resist this sort of attack.
Specifically if you're watching all traffic in and out, and you identify 18.104.22.168 as being popular - you don't know if that's an endpoint, or a router, a server/client uploading or downloading something. All you know is that it's Tor traffic. Tor is set up so that that's not really interesting information - the fact that you're running Tor isn't a secret (and as you noted, they publish the list of exit nodes for blacklisting purposes, but all non-bridge nodes are listed in the regularly published relay descriptors).
It's a bit different if you already have some suspects, timing attacks can work in this case - but at the end of the day, you can likely only show that two machines are communicating, not what they're communicating about, and you don't definitively know they're not just a router in the transaction.
Finally, if the service you're trying to identify is a Hidden Service all bets are likely off - they're designed to distribute the sort of traffic you're looking for on one link by deliberately adding a number of pre-trusted routers into the equation, which would negate any knowledge you had of the network.