Most first-time buyers spend 40 hours browsing listings and 4 hours verifying the one they buy. That ratio is backwards. Here's the exact 5-category framework I use to tear a deal apart before any money moves — and how to know when to walk.
Deal Alert AI is reader-supported. We earn commissions from affiliate links at no cost to you.
This post is based on a video from our Deal Alert AI YouTube channel. Watch the original or read the full breakdown below.
By Sophal Lanh, Founder of Deal Alert AI
The worst acquisition I ever watched happen up close was a $180,000 content site. Clean-looking P&L. Eighteen months of screenshots showing $6,200/month in AdSense and affiliate revenue. Seller was responsive, friendly, answered everything fast. The buyer wired the money through escrow, took over, and by month four the site was doing $1,900/month.
Nothing was technically fraudulent. The revenue had been real. What the buyer never checked was that 71% of the site's organic traffic came from a single article ranking #2 for a high-volume keyword — and that article had been slowly sliding since a Google core update four months before the listing went live. The seller wasn't lying. The seller was selling at exactly the right time, which is what smart sellers do.
Due diligence isn't about catching liars. Most sellers on reputable marketplaces aren't lying. Due diligence is about understanding what you're actually buying, where the fragility lives, and whether the price reflects the risk. This is the framework I run every deal through, broken into five categories. Skip any one of them and you're gambling.
Here's the pattern I see constantly. A buyer spends six weeks scrolling listings on Empire Flippers and Flippa, gets emotionally attached to one listing, then does a rushed weekend of "verification" that mostly consists of reading the prospectus twice and asking the seller three softball questions. The emotional commitment happens before the analytical work, which means the analytical work becomes an exercise in confirming a decision that's already been made.
Flip it. Do your broad filtering fast and mechanically. Kill 95% of listings in under two minutes each using hard criteria — multiple too high, traffic concentration obvious from the prospectus, revenue model you don't understand, niche you can't operate. Then spend 15 to 25 hours on the two or three deals that survive. Deep work on few deals beats shallow work on many.
The second mistake is treating due diligence as a pass/fail test. It isn't. Almost every business has problems. A site with declining traffic isn't automatically a no — it might be a yes at 24x instead of 38x. The point of due diligence is to price risk accurately, not to find a perfect business. Perfect businesses don't get sold, or if they do, they get bid up past the point where you make money. Your edge as a buyer is being the person who understands the flaws well enough to price them and fix them.
Key insight: The goal of due diligence isn't to find a flawless business. It's to build an accurate picture of the risks so you can either negotiate the price down, structure an earnout, or walk away with your capital intact. A deal you correctly price at 26x beats a deal you emotionally overpay for at 40x every single time.
We scan Empire Flippers, Flippa, Acquire.com and Quiet Light daily — scoring every listing. Start free.
Never, under any circumstances, accept a screenshot as proof of revenue. Screenshots are trivially editable. Even PDF exports can be manipulated. What you want is direct, read-only access to the source systems: Stripe, Shopify, PayPal, Google AdSense, Amazon Associates, the affiliate networks, whatever generates the money. Most reputable brokers will facilitate a screen-share session at minimum; the better sellers will grant temporary read-only logins during the exclusivity period.
Once you're in, pull 24 months of monthly data — not 12. Twelve months hides seasonality and hides the "we spiked once and it's been coasting down since" pattern. With 24 months you can see the shape of the business. Build a simple month-by-month table: gross revenue, refunds, net revenue, cost of goods, ad spend, tools, contractors, net profit. Do it yourself in a spreadsheet. Do not import the seller's spreadsheet and trust the formulas. I've found broken formulas in seller P&Ls three separate times, always in a direction that flattered the business.
For recurring revenue businesses — SaaS, memberships, subscription boxes — churn is the entire game. Ask for monthly churn by cohort. A SaaS doing $10,000 MRR with 3% monthly churn is a fundamentally different asset than one doing $10,000 MRR with 9% monthly churn, even though the trailing twelve months look identical. At 9% you're replacing your whole customer base every 11 months and the moment you slow down acquisition spend, the business melts. Also check whether "MRR" includes annual plans amortized correctly or whether the seller is booking annual payments as one-month spikes.
Watch for the specific patterns that signal engineered financials: a revenue spike in the three months immediately before listing (common — sellers ramp ad spend or run promotions to inflate the trailing average), expenses that mysteriously drop in the last quarter (owner stopped paying for tools or contractors to boost net profit), refund rates that are conspicuously absent from the P&L, and add-backs that don't hold up. Add-backs are legitimate when they're genuinely one-time or genuinely personal — a conference trip, a legal fee for incorporating. They're not legitimate when the seller adds back "content creation" as an owner expense on a content site that needs content to survive.
For any business where organic search drives customers, this category matters more than the financials. Revenue is a lagging indicator. Traffic is the leading one. A site can post its best revenue month ever while its organic footprint is quietly collapsing underneath it.
Start with Google Search Console, accessed directly — not a screenshot, not an export, direct access with your own eyes on the interface. Pull 16 months of clicks and impressions. Look at the trend line, but more importantly look at the impressions trend separately from clicks. Impressions falling while clicks hold steady means rankings are eroding on secondary keywords and the drop will hit clicks eventually. Then go to the Pages report and check concentration: how much of total traffic comes from the top page? Top five pages? If one URL drives more than 40% of sessions, you've got a single point of failure. Above 70% and you're not buying a business, you're buying a lottery ticket on one Google ranking.
Next, run the domain through Ahrefs or Semrush and pull the historical organic traffic graph going back three to five years. This is where penalty history shows up. You're looking for cliff drops that align with known Google update dates — a site that lost 60% of traffic in September 2023 and rebuilt to a new peak has a very different risk profile than one that's been flat for four years. Also check the backlink profile for obvious paid-link footprints: sudden bursts of links from unrelated foreign-language sites, guest-post networks, or the same 40 domains linking to every money page. Toxic link profiles are inherited liabilities.
Finally, verify the keyword portfolio makes commercial sense. Pull the top 50 keywords by traffic value and check their actual current positions yourself in an incognito window. I've seen prospectuses claim a #3 ranking that turned out to be #11 after a recent update. Also examine keyword difficulty and who else ranks — if positions 1, 2, and 4 are now occupied by Reddit, YouTube, and a major publisher, that #3 spot has a short life expectancy.
Red flag: If a seller refuses direct Search Console or analytics access and offers only exports or a recorded screen-share, treat it as a hard no. There is no legitimate reason to withhold read-only access during an exclusivity period on a six-figure transaction. Brokers on Empire Flippers will arrange this as standard practice. If you're buying direct or on an open marketplace and the seller stonewalls, walk.
Every listing says "runs on 5 hours a week." Almost none of them do. The operations review exists to figure out what the actual weekly workload is, who currently does it, and whether those people stay after closing.
Ask for a complete inventory of every tool and subscription the business touches, with monthly cost and who holds the account. This list is always longer than the P&L suggests. Hosting, email service provider, CDN, page builder, SEO tools, design software, project management, customer support desk, payment processor fees, plugins with annual renewals, stock photo subscriptions. I regularly find $300 to $800 a month in tooling that never made it into the seller's expense line because it was on a personal credit card. That's $3,600 to $9,600 a year of real profit that disappears from your model — at a 32x monthly multiple, that's $9,600 to $25,600 of overpayment.
Then map the people. Every VA, freelance writer, developer, designer, and customer support contractor. Get their rate, their hours, how long they've worked on the business, whether they're on a platform like Upwork or paid direct, and critically — whether the seller has asked them if they'll stay. A content site with a writer who's been producing for three years at $0.06/word and knows the brand voice is worth meaningfully more than one where you'll be rebuilding a content team from scratch. Contractors are not contractually obligated to transfer. Confirm before closing.
Last, document every process that requires the owner personally. Does the seller personally negotiate affiliate rates? Personally handle the relationship with the one supplier? Personally write the newsletter that drives 30% of sales in their distinctive voice? These are the things that don't show up in a P&L and don't transfer in an asset purchase agreement. Ask directly: "Walk me through your last full week, hour by hour." The answer to that question tells you more about operational reality than any prospectus.
This is the category buyers skip because it's tedious and feels like lawyer stuff. It's also the category that produces the ugliest surprises, because legal problems don't degrade gracefully — they either don't exist or they blow up the entire acquisition.
Start with domain ownership. Run a WHOIS lookup and confirm the registrant matches the seller's legal entity. Check the domain's registration history and expiry date. Confirm it's not locked into a registrar the seller can't transfer from, and confirm there are no outstanding disputes. Then check the domain's history on the Wayback Machine — if the domain was previously a gambling site, a pharmacy spam operation, or an expired brand someone rebuilt, that history can carry SEO baggage and, occasionally, trademark exposure.
Trademark status matters more than most buyers realize, especially for ecommerce and consumer brands. Search the USPTO database (and the equivalent in your target markets) for the brand name. Two scenarios are bad: the seller has no trademark and someone else owns a confusingly similar mark in the same class, or the seller has an application in progress that won't transfer cleanly. For a brand you're paying six figures for, the ability to defend the name is part of what you're buying. If it isn't defensible, that's a price adjustment.
Then run the checks that take twenty minutes and occasionally save you everything: search the seller's name and business name for litigation history, check for outstanding complaints with consumer protection bodies, verify supplier and manufacturer agreements explicitly permit assignment to a new owner, and confirm any affiliate program memberships (Amazon Associates in particular) can be re-established under your account. Amazon Associates accounts do not transfer. You apply fresh and you get approved fresh — and if you're new, there's a real approval risk on a site making $8,000/month from Amazon links. Know that before you close, not after.
Key insight: Ask for the asset list in writing and compare it line by line against what you assumed you were buying. Social accounts, email lists, product photography rights, custom code, trademarks, supplier relationships, and third-party account access are all separately negotiable. I've seen deals where the buyer discovered post-close that the 40,000-subscriber email list was on the seller's personal ESP account and was never included in the purchase agreement.
Documents tell you what happened. The seller call tells you what's going to happen. Take it seriously, prepare for it, and pay attention to hesitation as much as content. Record it if the seller consents, because you will want to re-listen to specific answers later.
Question one: "Why are you selling?" Everyone asks this, most people accept the first answer. The first answer is always rehearsed — "focusing on other projects," "portfolio rebalancing," "family reasons." Ask a follow-up: "What made now the right time specifically, versus six months ago or six months from now?" Timing reveals motive. If the honest answer is "traffic peaked and I think it's downhill from here," a good seller will hedge toward it and a great buyer will hear it.
Question two: "What would you do differently if you were keeping it another three years?" This is my favorite question in the entire process. Sellers love answering it because it lets them demonstrate expertise, and in doing so they hand you a free strategic roadmap and, usually, an unfiltered list of the business's weaknesses. "I'd finally fix the email flow, it's basically dead" tells you both an opportunity and a current fragility.
Question three: "Describe a bad month. What happened and what did you do?" Every business has had one. A seller who says there's never been a bad month is either not paying attention or not being straight with you. The specifics of how they diagnosed and responded tells you how volatile the business is and how much operator skill it requires. Question four: "Who are your top three customers, partners, or traffic sources, and what happens if one disappears?" For ecommerce, that might be a supplier. For an agency, three clients might be 60% of revenue. For an affiliate site, it might be one merchant program. Concentration risk lives everywhere, and the seller call is where you find the version that never appeared in a spreadsheet.
Before money moves, every item below should have a documented answer. Not a vibe, not a "the seller said" — a verified answer you could show someone else. I keep this as a literal checklist and I don't sign until all twelve are green or consciously accepted as a priced risk.
Twelve items sounds like a lot. In practice, a focused buyer can clear all of them in 15 to 20 hours for a typical six-figure content or ecommerce deal. That's two working days to protect a hundred thousand dollars or more. The math on that time investment is not close.
The framework above is thorough, which is exactly the problem — you cannot run it on fifty listings. Marketplaces list hundreds of new businesses every month across Empire Flippers, Flippa, and the other major platforms. If you're evaluating each one manually, you'll burn out before you find a good deal, and the good deals move fast — the best-priced listings on Empire Flippers routinely go under offer within days.
This is the specific problem I built Deal Alert AI to solve. It monitors listings across major marketplaces and scores them against the same risk dimensions this framework covers — multiple relative to comparable sales in the niche, revenue trend direction, traffic dependency signals, business model durability, and how the asking price stacks up against what similar businesses actually sold for. The output isn't a recommendation to buy. It's a filter that tells you which three listings out of two hundred deserve 20 hours of your attention.
The workflow that works: let the pre-scoring handle the mechanical elimination, then apply this five-category framework in full on the survivors. You're not outsourcing judgment — you're outsourcing the tedious first pass so your judgment gets spent where it matters. Buyers who use Deal Alert AI this way tend to look at fewer deals and close better ones, because their diligence energy isn't already spent by the time they find something good.
One more thing on process: keep a written record of every deal you pass on and why. Six months later, check what happened to those businesses. That feedback loop is how you calibrate. You'll discover you're systematically too cautious about one risk factor and not cautious enough about another, and that self-knowledge compounds faster than any checklist. You can start building that habit today at Deal Alert AI.
It will. Roughly nine out of ten deals I've run through this framework surfaced something material. The question is never "is it clean" — it's "is this problem priced in, fixable, or fatal?"
Priced-in problems get a number attached. Found $500/month in tooling the seller left off the P&L? At a 30x multiple that's a $15,000 price reduction and it's not a negotiation, it's arithmetic. Traffic down 15% over the trailing six months? That's not a walk-away, that's a discussion about whether the multiple should be 28x on current run-rate rather than 34x on trailing twelve-month average. Bring the evidence, state the adjustment plainly, and let the seller respond. Sellers who've done real work on their business respect a buyer who shows their math.
Fixable problems are your actual opportunity. A site with terrible email monetization, a Shopify store with a 4.1-second load time, a SaaS with no annual plan option — these are reasons the business is underpriced relative to what you can make it worth. But only count a fix as value if you have specific, demonstrated ability to execute it. "I'll improve conversion rate" is not a plan. "I've run this exact email flow on two prior stores and lifted revenue 18%" is.
Fatal problems get a walk. Unverifiable revenue. A seller who won't grant analytics access. Traffic dependent on one page that's already declining. A trademark conflict with a larger company. Amazon Associates dependency where you can't confirm approval. Legal exposure of any kind. The discipline to walk from a deal you've spent 20 hours on is the single most valuable skill in this business, because the sunk cost pressure at that moment is enormous and every buyer who's lost money will tell you the warning signs were there before they wired.
There will always be another deal. Marketplaces publish new inventory every week and the fram
We scan Empire Flippers, Acquire, Flippa, and Quiet Light daily. The best sub-$500K businesses are gone within 48 hours.