Actually, here's (simplified) what I've done. I'm thinking of writing an article on it. It's not my first acquisition.....
1. Got all the independent stats that I could to evaluate it.
- many independent lists of incoming links such as those provided by
www.webuildpages.com
- alexa etc
2. Check hosting status (including blacklisting) using
http://www.dnsstuff.com/
3. Get them to supply:
- traffic by month for the last year
- explanations of traffic trends
- data on referrals by country and domain
- disclosure on relationships for sites with links and sites providing traffic
4. Put in critical data in the purchase agreement in the "reps and warranties". This means that they, as part of the contract, represent that they've disclosed the truth about the data that they've supplied me (which I made part of the contract as an attachment).
5. Staged acquisition with payment tied to deliverables