website

get screen grabs of google analytics reports.
screen shots of earnings reports.

of course do your own due diligence on page rank and domain links etc.

No matter what pay with some kind of escrow account so you can back up if its not above board.

flippa.com just like an ebay for website and apps.

i had more success making my own websites. got lazy, bought a couple sites never had the same results. but its any thing is possible

The two biggest factors when buying a website are:

1) Traffic
2) Revenue

And you need to do EVERYTHING YOU CAN to fully validate both before moving forward with a website purchase.

Verifying traffic - Having the site owner add you to the users in their analytics software is about the best you can do. The vast majority of analytics users are using Google Analytics, and the seller should be able to easily add you as a user.

Verifying revenue - The best way to verify revenue is to get on a Skype call with the seller and have them screen share with you. Have them take you into their site's "control panel" and show you orders (noting names of several customers). Then have them take you into their payment processing interface and show you matching payments (match up to the names you previously noted).

There will still be some risk, but this is about the safest approach you can take. As said above, it's also a good idea to use escrow.com while you validate everything you were told about the site. I usually do a 2+ day review period, and that gives you time to complete due diligence and verify everything.

I hope this helps!