Check web logs for regular visits from a specific IP address. Setup alternate site (eg: on a different port) and use firewall rules to direct http traffic from that IP to that port. Make a small change to the site and verify that the copied site is altered. Then have fun.
It would be simpler to handle it in the application.
if ($ip == 'XXX.XXX.XXX.XXX') {
require 'poison.html';
exit;
}
Setting up a new site is trivial to do and allows you to mess around with it without modifying your main site... which may not be so simple as your example if it's based on a CMS or other framework.
Agreed. The vigilante content of the switcheroo is whatever. I want to know how he actually pulled it off. The not-so-over-the-top-vigilante-ish alternatives are pretty endless.