There are two types of "vhosts": real and fake.
Real vhosts are usually called "reverse DNS" (also called rDNS) - it's basically a DNS record for your IP address, pointing to some domain name with a
PTR record, which is looked up by the server upon connection (be it
httpd, or anything else). This is the "Looking up your hostname..." notice you see immediately after connecting to IRC.
If a user connects from
2001:db8::42, for example, a DNS lookup is performed for
188.8.131.52.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.. If the user connected from
192.0.2.123, the equivalent DNS name will be
184.108.40.206.in-addr.arpa.. The reverse DNS can be changed by whoever controls the IP address block. If you have a single IPv4 address for your home network, you usually have to annoy your ISP to get the rDNS changed.
To avoid spoofing, an
ircd (the IRC server program) will compare reverse and forward DNS - that is, it will make sure your rDNS points back to your IP address - before displaying it to other users.
For those who are unable to change their real rDNS, most IRC networks offer "virtual hosts" or "cloaks".
Almost every IRC daemon has the ability to change user's displayed hostname at any time; usually this is restricted to operators, or even to services. For example, with the IRC command
/chghost joeuser joes-fake-hostname.net (assuming sufficient privileges).
On most networks this process is automated by services - once an operator assigns you a vhost (cloak), you get it set every time you identify to your services account.
(I'm saying "services", not "NickServ" or "HostServ", because most of the time it is a single program presenting itself as all of them Servs.)