Another point: security features to avoid detection, like hiding IP addresses, using proxies or VPNs, or having .onion domains. Some sites might have fake payment pages to deter law enforcement.