In all honesty though, you're probably just going to have to take the loss. Better due diligence would be asking for 3+ months of revenue figures and google analytics data (even get the login to the account). The fact that he "couldn't get google analytics working" would have sent up red flags for me, because how do you develop that site if you can't paste a couple lines of javascript. Also, about the revenue, it's way to easy to sort of pump and dump sites like this or even fake traffic/revenue. You really need a real track record, not 30 random days of data.