Personally, first thing I check is the ICOs website, is it secured? Then I check if the team members are listed on their website, I Google each team members name and also check their LinkedIn profile to see how experienced they are. Also check if they have credible Advisors e.g. Vitalik Butterin or Charlie Lee or someone with a great track record. I check their social media presence, when was the account created? Are the accounts run by a robot?etc. Also read their whitepaper, is it realistic? can it be achieved? How many competitors do they have?
 These are just the few things I check but still doesn't make the ICO 100% legit but at least it's like 70%.