nytimes: Internet Used to Find Man Who Is Charged in 2 of 10 Killings
The NY Times describes a police investigation that tracked an accused murderer's internet use. Web server logs and MSN dialup records were apparently used, though the article doesn't mention warrants.
Four days later, investigators determined that the return address on the letter, "I THRALLDOM," was a Web site featuring bondage and sexual torture. Thralldom is defined as the condition of a servant or someone in moral or mental servitude. A search by Illinois State Police of Internet mapping companies led to an exact match between features on a map sent to the Post-Dispatch and one found on Expedia.com. On June 3, the Microsoft Corporation, which tracks access to that Web site, showed the F.B.I. that only someone with the Internet Provider address 65.227.106.78 visited the Expedia.com site and searched the West Alton area within days of the map's mailing to the Post-Dispatch. The user name of that IP address was "MSN/maurytravis." (see nytimes.com)