You can usually only narrow it down by getting the ISP to give up the person using an IP address at a given point in time which may itself require a warrant. Police are frequently failing to do even this.