Mystery URL

If you are the admin, or have the permission of the admin, install a keylogger. Odds are he is manually entering the URL in his browser. With a keylogger, you can see everything he types in the course of a day.

A number of firewalls have some basic reporting tools in them. Included should be something that reports on summary and/or detail of web addresses visited. That report can usually be filtered by IP.

Try that.

Thanks for all the suggestions ammo and everyone else. I do look after the network, although in an unpaid capacity. I'd have to get senior director approval really.